Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 8.0.29-13 (2026-08-20)

Installation Upgrade from MongoDB Community

Percona Server for MongoDB 8.0.29-13 is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.

Percona Server for MongoDB 8.0.29-13 includes the improvements and bug fixes of:

Upgrade recommendation

This release fixes one critical and several high-severity vulnerabilities affecting earlier Percona Server for MongoDB 8.0.x versions. We strongly recommend upgrading to version 8.0.29-13 as soon as possible.

Security fixes from upstream MongoDB

This release fixes vulnerabilities inherited from upstream MongoDB. The severity categories below follow the upstream CVSS scores .

Critical severity

  • SERVER-130264 (CVE-2026-18691 ): Fixed an issue in intra-cluster authentication where an attacker with access to cluster network traffic could influence the authentication mechanism used between replica set members. Under certain conditions, this could expose the cluster’s shared internal credential in a less-protected form. An attacker who recovered this credential could use it to authenticate to nodes with internal superuser privileges.

High severity

  • SERVER-130628 (CVE-2026-18687 ): Fixed an issue in Queryable Encryption maintenance operations where an authenticated user with readWrite privileges could submit a specially crafted request that was not properly validated against the collection’s encrypted field configuration. This could crash the server process, cause excessive internal writes, or corrupt encrypted index data.

  • SERVER-129617 (CVE-2026-18688 ): Fixed an issue in MongoDB Server’s aggregation framework where an authenticated user could trigger an out-of-bounds memory read by supplying a specially crafted numeric value to an aggregation pipeline stage. This could crash the server or expose a limited amount of process memory.

  • SERVER-130481 (CVE-2026-18690 , CVE-2026-18698 ): Fixed an issue where an authenticated user with limited database-level privileges could perform operations on protected system collections without the required permissions. This could allow critical system collections to be dropped and recreated.

  • SERVER-129994 (CVE-2026-18693 ): Fixed an issue with time series collections where an authenticated user with write access could insert documents that left an internal data structure in an inconsistent state. A later insert into the affected bucket could crash the server process, expose a limited amount of process memory, or corrupt memory.

  • SERVER-130188 (CVE-2026-18694 ): Fixed an issue in geospatial query processing where an authenticated user with write access could store malformed geometry data that the server later processed without proper validation. A query against the affected data could crash the server process or expose a limited amount of process memory.

  • SERVER-129460 (CVE-2026-18695 ): Fixed an issue in the processing of query predicates on time series collections with a metaField, where an authenticated user with write access could terminate the server process, resulting in a denial-of-service.

  • SERVER-130139 (CVE-2026-18696 ): Fixed an issue in the applyOps command where the namespace used for the permission check could differ from the namespace used by the operation. An authenticated user with certain non-default privileges could drop or modify collections outside their permissions.

  • SERVER-130110 (CVE-2026-18697 ): Fixed an issue in the aggregation framework where an unauthenticated user could crash a mongos process by sending a specially crafted aggregation command. This could cause a denial-of-service and interrupt client connections routed through the affected instance. This affects sharded clusters only.

  • SERVER-130111 (CVE-2026-18701 ): Fixed an issue in query processing where a user with read privileges could terminate mongod with a specially crafted query filter, resulting in a denial-of-service.

  • SERVER-130247 (CVE-2026-18711 ): Fixed an issue in the query execution engine where an authenticated user with read and write privileges could run a query against a time series collection that left the server referencing memory already released. This could crash the server process or return freed memory contents in query results.

  • SERVER-130633 (CVE-2026-18712 ): Fixed an authorization issue in Queryable Encryption maintenance operations where a user with privileges on one encrypted collection could modify or delete data in another collection.

Medium severity

  • SERVER-130266 (CVE-2026-18699 ): Fixed an issue in the query planner where a user with read privileges could terminate the server with a specially crafted query against a collection with a text index. This could result in a denial-of-service.

  • SERVER-130117 (CVE-2026-18700 ): Fixed an issue in geospatial validation where an authenticated user with write privileges could trigger invalid memory access through concurrent operations on a collection using a geospatial validator. This could crash the server process, resulting in a denial-of-service.

  • SERVER-130198 (CVE-2026-18702 ): Fixed an issue where a user with limited database-scoped privileges could change diagnostic logging settings for the entire server. This could suppress diagnostic logging or generate excessive log output.

  • SERVER-130167 (CVE-2026-18708 ): Fixed an issue in the JavaScript scripting engine where an authenticated user with write privileges could influence query execution for other users through a specially crafted stored value processed during internal maintenance. This could return incorrect query results or cause a denial-of-service for operations on the same database. The issue is confined to the scripting engine sandbox and does not grant access to filesystem or network resources.

  • SERVER-130544 (CVE-2026-18709 ): Fixed an issue in sharded clusters where a user with direct network access to a shard could commit or abort a prepared transaction without going through the expected transaction coordination process. This could cause cross-shard data inconsistencies, affect the cluster clock, and violate transaction atomicity.

For the complete upstream changelog, see MongoDB 8.0.29 Community Edition .

Tools packaged with this release

Tool Base version Release notes
MongoDB Shell (mongosh) 2.10.0 upstream release notes
Mongo Tools 100.18.0 upstream release notes