Exploited MongoBleed flaw leaks MongoDB secrets, 87K servers exposed

Published:

28 december 2025 om 20:38:15

Alert date:

28 december 2025 om 21:02:09

Source:

bleepingcomputer.com

Database & Storage, Zero-Day Vulnerabilities, Data Breach & Exfiltration

A severe vulnerability dubbed MongoBleed (CVE-2025-14847) affecting multiple MongoDB versions is being actively exploited in the wild. Over 87,000 MongoDB servers are exposed on the public internet, with more than 80,000 potentially vulnerable to this flaw. The vulnerability allows attackers to leak MongoDB secrets and sensitive information. Active exploitation has been confirmed, making this a critical security issue requiring immediate attention from organizations running MongoDB instances.

Technical details

MongoBleed (CVE-2025-14847) is a vulnerability in MongoDB's handling of network packets processed by the zlib library for data compression. The issue occurs because MongoDB returns the amount of allocated memory when processing network messages instead of the length of decompressed data. Attackers can send malformed messages claiming larger sizes when decompressed, causing the server to allocate larger memory buffers and leak in-memory data containing sensitive information. The vulnerability occurs before authentication, so no valid credentials are needed to exploit it.

Mitigation steps:

Upgrade MongoDB to safe releases (8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30). If upgrading is not possible, disable zlib compression on the server. Check for signs of compromise by looking for source IPs with hundreds or thousands of connections but zero metadata events. Use the MongoBleed Detector tool to parse MongoDB logs and identify potential exploitation. Consider using safe compression alternatives like Zstandard (zstd) or Snappy.

Affected products:

MongoDB 8.2.0 through 8.2.3
MongoDB 8.0.0 through 8.0.16
MongoDB 7.0.0 through 7.0.26
MongoDB 6.0.0 through 6.0.26
MongoDB 5.0.0 through 5.0.31
MongoDB 4.4.0 through 4.4.29
All MongoDB Server v4.2 versions
All MongoDB Server v4.0 versions
All MongoDB Server v3.6 versions

Related CVE's:

CVE-2025-14847

Related threat actors:

IOC's:

Source IP with hundreds or thousands of connections but zero metadata events, Malformed network messages to MongoDB instances, Unusual connection patterns to MongoDB servers

This article was created with the assistance of AI technology by Perceptive.