CVE-2026-18712

This vulnerability exposes a fundamental flaw in MongoDB Queryable Encryption's maintenance operations: internal metadata references are treated as trusted infrastructure rather than as attack surface requiring validation. The CVE allows an attacker with legitimate permissions on one encrypted collection to modify data in a different collection through maintenance operations that follow metadata references without re-checking authorization boundaries. This isn't privilege escalation — it's scope creep within permissions already held, exploiting the gap between collection-level authorization and cross-collection metadata infrastructure. The critical insight is that metadata corruption has wider blast radius than user data corruption. Maintenance operations can silently redirect destruction to unauthorized collections, but the downstream risk is worse: corrupting the encrypted index mappings and key references that QE requires to decrypt ANY data. If those mappings are corrupted, affected collections become cryptographically unrecoverable — a catastrophic integrity failure that may only surface during decryption attempts or backup verification, months after the exploit. The fix requires treating internal metadata as untrusted input, not as self-authenticating infrastructure. Any operation triggered from collection A that would modify collection B's state must perform the same authorization check as a direct operation against B, regardless of whether the target came from user input or internal metadata. Audit your QE deployment for maintenance operations: key rotation, re-encryption campaigns, and index rebuilds are the primary vectors. Verify whether your monitoring catches cross-collection metadata modifications, not just direct unauthorized accesses. The concerning open question is whether query execution paths — not just maintenance operations — share the same metadata-following trust assumptions, meaning the vulnerability could trigger on every encrypted query rather than only during administrative operations.

Reviewed through automated stages and approved by a human before publication.