CVE-2026-59509: Unauthenticated arbitrary MongoDB collection read in cve-search

Severity: critical (CVSS 9.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-05 · updated 2026-07-06
Weakness: CWE-20

Description

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

Affected products

cve-search: from v4.0 through v6.0.0

References

https://github.com/cve-search/cve-search/issues/1217
https://github.com/cve-search/cve-search/pull/1218

Get alerted when CVE-2026-59509 or the next vulnerability affects your stack