Search CVEs, research… / diras.sa

CVE-2026-93765: pre-auth unsafe reflection in MongoDB Mongoid

An unauthenticated party can send crafted input keys that, when passed through by an embedding application, trigger unintended internal method invocation in Mongoid, potentially causing removal of stored records or application unresponsiveness. CVE-2026-93765 affects Mongoid 8.0.0–8.0.12, 8.1.0–8.1.12, 9.0.0–9.0.11 and 9.1.0. Exploitation requires an attacker-controlled input whose keys are forwarded into Mongoid by the host application; no credentials are required within Mongoid itself.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.1CRITICAL
EPSS
0.00511
CWE
CWE-470
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: treat this as high priority because the flaw can be triggered without authentication and no fixed release is yet listed; immediately block or validate untrusted keys forwarded into Mongoid and limit public exposure of services that accept user-supplied document data.

What is CVE-2026-93765?

An unauthenticated party can send crafted input keys that, when passed through by an embedding application, trigger unintended internal method invocation in Mongoid, potentially causing removal of stored records or application unresponsiveness. CVE-2026-93765 affects Mongoid 8.0.0–8.0.12, 8.1.0–8.1.12, 9.0.0–9.0.11 and 9.1.0. Exploitation requires an attacker-controlled input whose keys are forwarded into Mongoid by the host application; no credentials are required within Mongoid itself.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Which versions of MongoDB Mongoid are affected?

BRANCHAFFECTEDFIXED
9.x9.1.0
9.x9.0.0 – 9.0.11
8.x8.1.0 – 8.1.12
8.x8.0.0 – 8.0.12

Is CVE-2026-93765 being exploited?

There are no public reports of exploitation as of 2026-09-30.

How to fix CVE-2026-93765

  1. Apply vendor guidance if released and track MongoDB/Mongoid advisories for a fixed release.
  2. Prevent untrusted input keys from being forwarded into Mongoid by validating or whitelisting allowed fields in the embedding application.
  3. Restrict network exposure of services that accept JSON or form data bound to Mongoid models, and require authentication where possible.
  4. Monitor application logs for unexpected method-invocation patterns and for deletions or failures linked to incoming payloads.

Frequently asked questions

Is CVE-2026-93765 being actively exploited?

There are no public reports of exploitation as of 2026-09-30.

Which Mongoid versions are affected by CVE-2026-93765?

The vulnerability affects Mongoid versions 8.0.0–8.0.12, 8.1.0–8.1.12, 9.0.0–9.0.11 and 9.1.0.

Is there a patch for CVE-2026-93765?

No fixed versions are listed in the available vendor information; monitor MongoDB/Mongoid advisories for an official patch.

Does CVE-2026-93765 require authentication?

No — the issue can be triggered by untrusted input keys forwarded by an embedding application without authentication to Mongoid.

References