MongoDB security advisory (AV26-911)

Published September 11, 2026

MongoDB's Java and PHP tools for databases have flaws that let attackers crash your app or read data they shouldn't. Update to the latest versions to fix them.

Severity
Not scoredNo CVSS score recorded
Fix
Not confirmed
Exploited
Not confirmedNo confirmation recorded

How it works

  • Attackers send specially crafted data to MongoDB's Java or PHP tools.
  • These tools don't check the data well enough, so they crash or let the attacker read private information from your database.

What to do

If you use MongoDB's Java Driver or Laravel MongoDB (PHP) package, check your installed versions. Open the package manager or your project's dependency list to see if you have Java Driver below 5.11.1 or Laravel MongoDB (PHP) below 5.11.0.

Update MongoDB's Java Driver to 5.11.1 or newer. Update Laravel MongoDB (PHP) to 5.11.0 or newer. Check the MongoDB advisory for full details: MongoDB Security Advisory AV26-911.

Technical details

MongoDB disclosed two driver vulnerabilities affecting unauthenticated clients that could allow remote code execution (RCE) by bypassing authentication checks. The MongoDB Java Driver before 5.11.1 and the Laravel MongoDB (PHP) driver before 5.11.0 contain flaws where improper input validation lets attackers craft malicious queries to execute arbitrary code on vulnerable systems. No CVSS score or CVE ID was assigned, but the advisory was published under AV26-911 on September 11, 2026. Updates to 5.11.1 (Java) and 5.11.0 (PHP) resolve the issue.

References

View Original Source