CVE-2026-18705

CVE-2026-18705 is an access control bypass in MongoDB Atlas Vector Search where authenticated users with read access to one view can retrieve documents from another view they should not access. The root cause is insufficient validation of user-supplied fields in the translation layer that converts search queries into internal document requests. When vector search constructs downstream queries, it fails to enforce the originating view's access boundaries on the transformed request — the security context gets lost in translation. The practical impact extends far beyond what the CVSS score suggests. Vector search typically powers retrieval-augmented generation (RAG) pipelines and AI systems that aggregate large document corpora. A medium-severity bypass in this context can expose sensitive documents that feed directly into LLM context windows, creating data exposure that CVSS fails to capture. The EPSS score of 0.00227 reflects narrow technical exploitability — authenticated access and specific view configurations are required — but the downstream data sensitivity in AI pipelines makes this worth prioritizing despite the low probability of mass exploitation. The fix patches the missing field validation check in the translation layer. However, this vulnerability follows a documented pattern across database vendors: Elasticsearch, Postgres, and Redis have all suffered equivalent flaws where user input crosses component boundaries during request transformation without carrying the access context. Each instance gets patched individually, but the structural tendency recurs because translation and adaptation layers are owned by no one — they're the seams where features ship fastest and security review attention lapses first. As MongoDB expands vector search capabilities across its product line, each new code path touching the search process risks reopening the same validation gap. For defenders: audit your Atlas deployments for any view configurations that use vector search indexes, verify which identities have access to those views, and treat the vector search component as a high-sensitivity boundary given its common role in AI data pipelines. The patch is necessary but insufficient — the architectural tension between separated search processes and access control enforcement is a recurring class, not a one-off incident.

Reviewed through automated stages and approved by a human before publication.