Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 8.0.28-12 (2026-08-10)

Installation Upgrade from MongoDB Community

Percona Server for MongoDB 8.0.28-12 is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.

Percona Server for MongoDB 8.0.28-12 includes the improvements and bug fixes of:

Upgrade recommendation

This release fixes one critical and several high-severity vulnerabilities that affect all Percona Server for MongoDB 8.0.x versions. We strongly recommend upgrading to version 8.0.28-12 as soon as possible.

Release highlights

Software Bill of Materials (SBOM)

Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) and Vulnerability Exploitability Exchange (VEX) for every release. SBOMs improve software supply chain transparency by documenting the components and dependencies included in a build. They are generated automatically as part of the release pipeline in the industry standard CycloneDX format.

SBOMs are distributed through the following channels:

  • Tarballs: An SBOM is included in doc/sbom.cdx.json file.

  • Packages: For .deb and .rpm packages, the SBOM file is installed in a standard documentation directory such as /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json.

  • Docker: The SBOM is attached directly to the Docker image as metadata.

OpenVEX files are published on GitHub Pages and provide the exploitability status of known vulnerabilities.

  • Each release has a separate file that follows this format:
https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-8.0.28-12.vex.json

For comprehensive information, refer to our documentation.

Extended platform support: RHEL 10 and its derivatives, and Debian 13

Percona Server for MongoDB 8.0.28-12 adds packages for new platforms, including RHEL 10 and its derivatives, and Debian 13.

Platform Derivative of Architecture
RHEL 10 — x86_64, ARM64
Rocky Linux 10 RHEL 10 x86_64, ARM64
AlmaLinux 10 RHEL 10 x86_64, ARM64
Oracle Linux 10 (RHCK only) RHEL 10 x86_64, ARM64
Debian 13 (Trixie) — x86_64, ARM64

You can install Percona Server for MongoDB 8.0.28-12 on Debian 13. Although upstream MongoDB does not yet list Debian 13 as a supported platform, Percona builds and tests these packages independently, making them available ahead of upstream support.

To install on a new platform, enable the repository with percona-release, then follow the installation steps for your package manager.

Changelog

New features

  • PSMDB-2150: Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) for every release.

  • PSMDB-1943: Added RHEL10 Build Support for Percona Server for MongoDB (PSMDB) 8.0.x.

  • PSMDB-2028: Added Debian 13 support for Percona Server for MongoDB (PSMDB) 8.0.x.

  • PSMDB-2120: Added Debian 13 (Trixie) ARM64 support for Percona Server for MongoDB (PSMDB) 8.0.x.

  • PSMDB-2165: Added Debian 13 Support for mongosh.

  • PSMDB-2168: Added RHEL 10 support for mongosh.

Bugs fixed

  • PSMDB-2212: Fixed an issue where mongod could terminate unexpectedly with a SIGABRT signal when using native LDAP authentication if an LDAP operation timed out. mongod now handles LDAP timeout conditions correctly, preventing unexpected process termination.

Security fixes from upstream MongoDB

Critical severity

  • SERVER-128494 (CVE-2026-13072 ): Fixed an issue where compute mode on a standalone MongoDB instance could cause memory corruption while processing externally sourced BSON data in an aggregation pipeline. This could cause the process to terminate or behave unexpectedly. Compute mode is disabled by default and must be enabled explicitly at startup.

High severity

  • SERVER-123081 (CVE-2026-13055 ): Fixed an issue in the $_internalIndexKey aggregation expression. An authenticated user with permission to run aggregation pipelines could submit a compound wildcard index specification that caused mongod to stop, resulting in a denial-of-service attack.

  • SERVER-124355 (CVE-2026-13056 ): Fixed an issue where specially crafted queries could generate excessively large intermediate arrays in memory. This could cause the server to run out of memory (OOM) and terminate unexpectedly.

  • SERVER-127661 (CVE-2026-13058 ): Fixed an issue where a specially crafted transaction command could cause the server to terminate unexpectedly, resulting in a denial-of-service.

  • SERVER-125872 (CVE-2026-13064 ): Fixed an issue where queries with deeply nested $jsonSchema expressions could cause excessive CPU usage, potentially leading to resource exhaustion.

  • SERVER-127280 (CVE-2026-13065 ): Fixed an input validation issue in $linearFill. A user with read-only access could provide an unsupported expression in sortBy, causing mongod to stop and resulting in a denial-of-service.

  • SERVER-127357 (CVE-2026-13060 ): Fixed an issue in the $graphLookup aggregation stage that could allow an authenticated user with limited read permissions to access documents from restricted collections. This could occur when the collections were referenced in an existing view pipeline.

  • SERVER-128387 (CVE-2026-13067 ): Fixed an issue where X.509 authentication through a PROXY protocol v2 Unix domain socket could assign roles without enforcing the configured tlsCATrusts allow-list.

  • SERVER-127566 (CVE-2026-13069 ): Added a limit for the contention value used with Queryable Encryption (FLE2). Previously, an authenticated user could submit a request with a very high value, consuming excessive CPU or memory and making the server slow or unresponsive.

  • SERVER-127694 (CVE-2026-13066 ): Resolved an issue where improper handling of DBPointer objects during BSON serialization in the server-side JavaScript engine could expose internal memory contents to the client. This information disclosure vulnerability affected deployments that use server-side JavaScript.

  • SERVER-127831 (CVE-2026-13062 ): Resolved an issue where an authenticated user with write privileges on a collection that supports Queryable Encryption could modify internal encryption metadata fields, which are intended to be controlled by the server. This was achieved by sending crafted write commands through the mongos router in a sharded cluster. As a result, this could lead to incorrectly encrypted queries.

  • SERVER-128433 (CVE-2026-13059 ): Resolved an issue where an authenticated user with limited privileges could bypass role-based query-level access controls by submitting specially crafted command parameters. This could allow unauthorized read or write operations through the find, update, delete, and aggregate commands when strict API rules were not enforced.

  • SERVER-128473 (CVE-2026-13071 ): Resolved an issue where an authenticated user with read access could terminate the mongod process using certain aggregation expressions that execute server-side JavaScript. This issue was caused by improper memory handling during document processing.

  • SERVER-129103 (CVE-2026-13077 ): Fixed an issue where MongoDB did not properly validate CodeWScope elements in malformed BSONColumn data. An authenticated user could exploit this with a crafted aggregation pipeline, causing mongod to stop or expose nearby process memory.

Medium severity

  • SERVER-126247 (CVE-2026-13057 ): Fixed an access control issue in Atlas Search that could allow authenticated users to bypass per-user restrictions in sharded deployments.

  • SERVER-127689 (CVE-2026-13061 ): Fixed an issue in the $listSessions aggregation stage that could expose session information to users without the required cluster-level privileges. An authenticated user could view other users’ session IDs, usernames, and activity timestamps.

  • SERVER-128362 (CVE-2026-13070 ): Resolved an issue where a MongoDB server could terminate unexpectedly while processing a malformed OCSP response during an outbound TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Exploitation required either a remote peer with a certificate issued by the cluster’s trusted certificate authority or a connection passing through an untrusted network path.

  • SERVER-128512 (CVE-2026-13073 ): Fixed an issue where X.509-authenticated users could receive unintended role assignments when using PROXY protocol v2 over Unix domain sockets.

  • SERVER-128517 (CVE-2026-13074 ): Fixed an issue where pre-authentication hello requests in exhaust mode accepted very small maxAwaitTimeMS values. An unauthenticated client could use this behavior to create a tight response loop that consumed excessive CPU and reduced server availability.

  • SERVER-128832 (CVE-2026-13078 ): Fixed an issue discovered in MongoDB Server, where the server-side MozJS scripting engine unconditionally registered a module-loading hook that enables JavaScript to read arbitrary files from the host filesystem using the mongod process’s privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

For the complete upstream changelog, see MongoDB 8.0.26 Community Edition .

Affected versions

These vulnerabilities affect the following versions:

  • All Percona Server for MongoDB 8.0.x versions

Tools packaged with this release

Percona repackages the upstream MongoDB Shell (mongosh) as percona-mongodb-mongosh, updating all copyright, authorship, and branding under the full product name “Percona MongoDB Shell.”

Percona also repackages and patches Mongo Tools. In this release, we’ve updated embedded Go libraries in the mongodump binary to address 15 security (severity from medium to critical) vulnerabilities:

Tool Base version Release notes
MongoDB Shell (mongosh) 2.9.2 upstream release notes
Mongo Tools 100.17.0 upstream release notes