Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 7.0.48-25 (2026-11-13)

Installation Upgrade

Percona Server for MongoDB 7.0.48-25 is a drop-in replacement for MongoDB Community Edition. It supports MongoDB Community protocols and drivers and provides enterprise-grade features at no cost.

This release includes the improvements and bug fixes from MongoDB 7.0.48 Community Edition .

Upgrade recommendation

This release fixes multiple security vulnerabilities inherited from upstream MongoDB. We strongly recommend upgrading to version 7.0.48-25 as soon as possible.

See Upgrade Percona Server for MongoDB for upgrade instructions.

Changelog

Bugs fixed

  • PSMDB-2279: Fixed AWS IAM authentication for assumed roles in non-commercial AWS partitions, including GovCloud and China. The server now preserves the partition when converting an assumed-role ARN to the IAM role ARN used to match a user in $external.

AWS IAM upgrade considerations

Before upgrading in GovCloud, China, or ISO partitions, review existing $external users named with IAM role ARNs. All sessions of the matching role can now authenticate as that user. Users named with full STS assumed-role session ARNs no longer match. Replace these per-session users with appropriately authorized IAM role-ARN users. See Configure AWS IAM authentication.

Issues fixed from upstream MongoDB

  • SERVER-138547 : Fixed directory names in cross-compiled MongoDB archives to reflect the target architecture.

Security fixes from upstream MongoDB

Severity follows the MongoDB-published CVSS 4.0 scores . The macOS entry applies only to the upstream platforms and configurations described below.

Critical severity

  • SERVER-138119 , SERVER-138175 (CVE-2026-118383 ): Fixed a use-after-free when a newly elected replica set primary completes catch-up. Unauthenticated requests could trigger a server crash or, under certain conditions, arbitrary code execution. The issue affects replica set members, including shard and config server members, but not standalone mongod instances.

  • SERVER-130681 (CVE-2026-120808 ): Fixed TLS certificate validation for outbound IPv6 connections on macOS with Apple SecureTransport. An attacker on the network path could intercept or modify traffic using a self-signed certificate with the target’s IPv6 address in its Subject Alternative Name.

High severity

  • SERVER-138119 (CVE-2026-120828 ): Fixed an issue where an unauthenticated user with network access could send read requests for a point in time that a replica set member would never reach. Internal wait records could accumulate after the requests ended, exhausting server memory and causing a denial-of-service.

  • SERVER-130261 (CVE-2026-120806 ): Fixed stale references left after dropping database roles. A user with database administrative privileges could recreate a role with different privileges, granting them to previously associated users without an explicit grant or audit event.

  • SERVER-130169 (CVE-2026-120807 ): Fixed an X.509 cluster authentication check that could grant internal system privileges to a holder of a valid cluster-member TLS certificate. Exploitation requires a non-default configuration and specific timing and error conditions during user lookup.

  • SERVER-132430 (CVE-2026-120810 ): Fixed missing memory limits for an internal aggregation expression accessible to authenticated clients. A user with read privileges could send crafted commands over concurrent connections, exhausting memory and causing the operating system to terminate mongod.

  • SERVER-132517 (CVE-2026-120813 ): Fixed an issue where a malicious client-side field-level encryption (CSFLE) schema could discard encryption metadata and leave fields in plaintext. Exploitation requires control over the schema sent to the client, such as by intercepting network traffic or using an untrusted server.

  • SERVER-134872 (CVE-2026-120815 ): Fixed an authorization check that could let an unauthenticated user with local host access gain administrative privileges on a server with authorization enabled. This could expose data and credentials, allow data changes, or disrupt service.

  • SERVER-135655 (CVE-2026-120817 ): Fixed a race condition during concurrent writes checked against a collection validator with geospatial operators. An authenticated user with write privileges could trigger the issue and crash the server.

  • SERVER-135727 (CVE-2026-120818 ): Fixed a use-after-free in server-side JavaScript during aggregation. An authenticated user, even without assigned roles, could submit a crafted request that returned unrelated server memory and, in some cases, affected server availability.

  • SERVER-136182 (CVE-2026-120822 ): Fixed an authorization bypass in a replication-related administrative command. A user with backup and restore privileges could read or relocate collections outside their permitted scope.

  • SERVER-136505 (CVE-2026-120824 ): Fixed a use-after-free when validating time series bucket documents during writes. An authenticated user with permission to write directly to bucket documents could crash the server or, under certain conditions, execute arbitrary code.

Medium severity

  • SERVER-135353 (CVE-2026-120811 ): Fixed a use-after-free in the classic query engine plan cache. Diagnostic commands from an authenticated user could expose server memory or, under certain conditions, crash the server.

For the complete upstream changelog, see MongoDB 7.0.48 Community Edition .

Tools packaged with this release

The following tool versions accompany this release:

Tool Base version Release notes
MongoDB Shell (mongosh) 2.14.1 Upstream release notes
MongoDB Database Tools 100.20.1 Upstream release notes