CVE-2026-18695

CVE-2026-18695 is a denial-of-service vulnerability in MongoDB's time-series collection query handling. When a metaField is defined in a time-series collection, a specially crafted predicate in a query can trigger a server crash. Exploitation requires an authenticated user with write access to the affected database—a constraint that pushes the CVSS to 6.5 but should not be mistaken for low urgency. The trigger condition is the diagnostic signal that matters here. Time-series collections and their metaField mechanism were introduced as a feature to support flexible metadata querying over time-ordered data. The crash occurs in predicate evaluation when the query engine encounters a specific structural configuration that the metaField query path doesn't handle correctly. This is not an authentication bypass or an access control failure—it is a logic error in how user-controlled metadata indirection interacts with query optimization. For defenders, three considerations should shape your response. First, the authenticated-user requirement is a blast-radius constraint, not a root-cause fix. A database crash in a replica set or sharded cluster is a consistency boundary event that can cascade beyond the MongoDB instance itself—especially in systems where MongoDB serves as the operational state store for queues, schedulers, or other stateful services. The operational impact of unplanned termination often exceeds what CVSS 6.5 implies. Second, this vulnerability belongs to a genotype that has appeared before in MongoDB's ecosystem. The aggregation framework, document validation, and change stream handling have each produced predicate-evaluation bugs that crash servers when authenticated users submit query shapes the code path didn't anticipate. This pattern suggests the metaField query path is likely receiving its first adversarial review, not an isolated coding error. Third, determine whether your deployment uses time-series collections with a metaField. If it does, prioritize patching regardless of the CVSS score. If time-series collections are not in use, the attack surface is nil. The EPSS score is currently low, but that reflects the absence of public proof-of-concept code, not the difficulty of exploitation once a PoC emerges. Monitor MongoDB's patch releases closely—this is the vulnerability class where a PoC appearing on GitHub can shift active exploitation from unlikely to imminent within days.

Reviewed through automated stages and approved by a human before publication.