Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 7.0.40-22 (2026-08-19)

Installation Upgrade from MongoDB Community

Percona Server for MongoDB 7.0.40-22 is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.

Percona Server for MongoDB 7.0.40-22 includes the improvements and bug fixes of:

Upgrade recommendation

This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 7.0.x versions. We strongly recommend upgrading to version 7.0.40-22 as soon as possible.

Security fixes from upstream MongoDB

This release fixes vulnerabilities inherited from upstream MongoDB. The severity categories below follow the upstream CVSS scores .

Critical

  • SERVER-130264 (CVE-2026-18691 ): Fixed an issue in intra-cluster authentication where an attacker with access to cluster network traffic could influence the authentication mechanism used between replica set members. Under certain conditions, this could expose the cluster’s shared internal credential in a less-protected form. An attacker who recovered this credential could use it to authenticate to nodes with internal superuser privileges.

High severity

  • SERVER-129617 (CVE-2026-18688 ): Fixed an issue in MongoDB Server’s aggregation framework where an authenticated user could trigger an out-of-bounds memory read by supplying a specially crafted numeric value to an aggregation pipeline stage. This could crash the server or expose a limited amount of process memory.

  • SERVER-130481 (CVE-2026-18690 , CVE-2026-18698 ): Fixed an authorization issue where an authenticated user with limited database-level privileges could perform operations on protected system collections beyond their assigned permissions. This could allow the user to drop and recreate critical system collections without the required authorization.

  • SERVER-129994 (CVE-2026-18693 ): Fixed an issue in Percona Server for MongoDB’s handling of time series collections. An authenticated user with write access could insert certain documents. This could leave an internal data structure in an inconsistent state. A later insert into the affected bucket could access memory outside its intended bounds. This could cause a server crash, limited memory exposure, or memory corruption.

  • SERVER-130188 (CVE-2026-18694 ): Fixed an issue in Percona Server for MongoDB’s geospatial query processing. An authenticated user with write access could store malformed geometry data. The server could later process this data without proper validation. A subsequent query could access memory outside its intended bounds. This could cause a server crash or expose a limited amount of process memory.

  • SERVER-129460 (CVE-2026-18695 ): Fixed an issue in the processing of query predicates on time series collections with a metaField, where an authenticated user with write access could terminate the server process, resulting in a denial-of-service.

  • SERVER-130139 (CVE-2026-18696 ): Fixed an authorization bypass in the applyOps command. The namespace used for the permission check did not always match the namespace the operation ran against, so an authenticated user with certain non-default privileges could drop or alter collections outside their permissions.

  • SERVER-130110 (CVE-2026-18697 ): Fixed an issue in the aggregation framework where an unauthenticated user could terminate a mongos process by sending a specially crafted aggregation command. This could cause a denial-of-service and interrupt client connections routed through the affected mongos instance.

  • SERVER-130111 (CVE-2026-18701 ): Resolved an issue in MongoDB Server’s query subsystem where an authenticated user with read privileges could cause mongod to terminate by submitting a specially crafted query filter. This could result in a denial-of-service.

  • SERVER-130633 (CVE-2026-18712 ): Fixed an authorization issue in Queryable Encryption maintenance operations where a user with privileges on one encrypted collection could modify or delete data in another collection. The issue was caused by insufficient validation of internal metadata references before operating on other namespaces.

Medium severity

  • SERVER-130266 (CVE-2026-18699 ): Resolved an issue in MongoDB Server’s query planner where an authenticated user with read-level privileges could cause the server process to terminate by submitting a specially crafted query against a collection with a text index. This could result in a denial-of-service attack, disrupting connected clients and in-flight operations.

  • SERVER-130117 (CVE-2026-18700 ): Fixed an issue in geospatial validation where an authenticated user with write privileges could trigger invalid memory access through concurrent operations on a collection configured with a geospatial validator. This could cause the server process to crash, resulting in a denial of service. Users should review collections that use geospatial validation rules.

  • SERVER-130198 (CVE-2026-18702 ): Fixed an issue where an authenticated user with limited database-scoped privileges could change diagnostic logging settings at the server level. This could suppress diagnostic logging across the server or generate excessive log output, reducing the effectiveness of operational monitoring.

  • SERVER-130167 (CVE-2026-18708 ): Fixed an issue in the JavaScript scripting engine where an authenticated user with write privileges could influence query execution for other users through a specially crafted stored value processed during internal maintenance. This could return incorrect query results or cause a denial of service for operations on the same database. The issue is confined to the scripting engine sandbox and does not grant access to filesystem or network resources.

  • SERVER-130544 (CVE-2026-18709 ): Fixed an issue in sharded clusters where an authenticated user with direct network access to a shard could commit or abort a prepared transaction without going through the expected transaction coordination process. This could cause cross-shard data inconsistencies, affect the cluster clock, and violate transaction atomicity.

For the complete upstream changelog, see MongoDB 7.0.40 Community Edition .

Tools packaged with this release

Tool Base version Release notes
MongoDB Shell (mongosh) 2.10.0 upstream release notes
Mongo Tools 100.18.0 upstream release notes