CVE-2026-59509: critical vulnerability in cve-search
Unauthenticated arbitrary MongoDB collection read in cve-search
Published · Updated
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.2epss 1.4%
exploitation probability
1.4%top 27% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
cve-search · cve-searchpublic PoCs found — 1
cve_referencegithub.com/cve-search/cve-search/issues/1217unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.