MongoDB BSON Symbol Type Bypasses Authorization Check (CVE-2026-18690)
MongoDB CVE-2026-18690: a BSON symbol-typed collection name bypasses authorization checks, letting limited users reach protected system collections.
On August 11, 2026, MongoDB disclosed four Server vulnerabilities, all patched together in 8.0.29 / 7.0.40 / 8.3.8. CVE-2026-18690 (CWE-863, CVSS 3.1: 8.1) is a precise logic flaw in how MongoDB parses a collection name twice per command. The vulnerable parseNsFromCommand function only recognizes a BSON String type; when the collection name arrives as a deprecated BSON 'symbol' instead, the function falls back to a database-only namespace for authorization purposes, while execution still reads the symbol's text and resolves the real, intended collection.
Because authorization ends up checking a broad database-level permission instead of the specific protected collection, a user holding only an ordinary database-scoped role (such as readWrite) can send commands with a symbol-typed collection name to reach system collections like system.profile or system.views that should be off-limits. Testing against a live MongoDB 8.0.28 confirmed the split: the same command sent with a string collection name is correctly rejected with Unauthorized, while the symbol-typed version passes authorization and only fails later, at execution, proving the security check never fired.
This requires an already-authenticated, low-privileged account — it's a privilege-escalation bug inside a multi-tenant deployment, not an unauthenticated remote exploit. The same disclosure batch includes CVE-2026-18691, a more severe intra-cluster authentication downgrade rated CVSS 4.0 9.0. MongoDB's fix is a single added type check in the source; there is no configuration workaround, so upgrading to 7.0.40, 8.0.29, or 8.3.8 is the only remedy.