Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 8.0.38-16 (2026-11-13)

Installation Upgrade

Percona Server for MongoDB 8.0.38-16 is a drop-in replacement for MongoDB Community Edition. It supports MongoDB Community protocols and drivers and provides enterprise-grade features at no cost.

This release includes the improvements and bug fixes from MongoDB 8.0.37 Community Edition and MongoDB 8.0.38 Community Edition .

Upgrade recommendation

This release fixes multiple security vulnerabilities inherited from upstream MongoDB. We strongly recommend upgrading to version 8.0.38-16 as soon as possible.

See Upgrade Percona Server for MongoDB for upgrade instructions.

Changelog

Bugs fixed

  • PSMDB-2279: Fixed AWS IAM authentication for assumed roles in non-commercial AWS partitions, including GovCloud and China. The server now preserves the partition when converting an assumed-role ARN to the IAM role ARN used to match a user in $external.

AWS IAM upgrade considerations

Before upgrading in GovCloud, China, or ISO partitions, review existing $external users named with IAM role ARNs. All sessions of the matching role can now authenticate as that user. Users named with full STS assumed-role session ARNs no longer match. Replace these per-session users with appropriately authorized IAM role-ARN users. See Configure AWS IAM authentication.

Issues fixed from upstream MongoDB

  • SERVER-138547 : Fixed directory names in cross-compiled MongoDB archives to reflect the target architecture.

Security fixes from upstream MongoDB

The following entries describe upstream MongoDB security fixes. Severity follows the MongoDB-published CVSS 4.0 scores . Platform-specific entries retain their upstream scope and do not imply that Linux deployments are affected.

Critical severity

  • SERVER-138119 , SERVER-138175 (CVE-2026-118383 ): Fixed a use-after-free when a newly elected replica set primary completes catch-up. Unauthenticated requests could trigger a server crash or, under certain conditions, arbitrary code execution. The issue affects replica set members, including shard and config server members, but not standalone mongod instances.

  • SERVER-130681 (CVE-2026-120808 ): On macOS with Apple SecureTransport, outbound TLS connections to IPv6 peers could bypass certificate trust validation. An attacker on the network path could use a self-signed certificate containing the target’s IPv6 address in its Subject Alternative Name to intercept or alter the traffic.

High severity

  • SERVER-138119 (CVE-2026-120828 ): Fixed an issue where an unauthenticated user with network access could send read requests for a point in time that a replica set member would never reach. Internal wait records could accumulate after the requests ended, exhausting server memory and causing a denial of service.

  • SERVER-130261 (CVE-2026-120806 ): Dropping database roles could leave stale user and role references. Recreating a role with different privileges could then grant those privileges to previously associated users without an explicit grant or audit event. Exploitation requires database administrative privileges.

  • SERVER-130169 (CVE-2026-120807 ): With a non-default X.509 cluster authentication configuration, user lookup errors could let a holder of a valid cluster-member certificate bypass the membership guard and gain internal system privileges.

  • SERVER-132430 (CVE-2026-120810 ): An authenticated user with read privileges could exhaust server memory through crafted aggregation requests using an internal expression, causing mongod to terminate.

  • SERVER-132517 (CVE-2026-120813 ): A malicious client-side field-level encryption (CSFLE) schema could cause encryption metadata to be discarded, leaving fields intended for encryption stored in plaintext. Exploitation requires control over the schema delivered to the client, such as through an untrusted server or interception.

  • SERVER-133600 (CVE-2026-120814 ): A user with certain shard-level administrative privileges and direct access to a cluster member could cause internal coordination state to be processed with elevated authority, allowing unauthorized data access and changes across the cluster.

  • SERVER-134872 (CVE-2026-120815 ): An incorrect localhost-exception check could let an unauthenticated user with local access obtain administrative privileges, exposing data and credentials and allowing data modification or service disruption.

  • SERVER-135655 (CVE-2026-120817 ): Concurrent writes checked against a collection validator with geospatial query operators could trigger a race condition and crash the server. Exploitation requires an authenticated user with write privileges.

  • SERVER-135727 (CVE-2026-120818 ): An authenticated user, even without assigned roles, could submit a crafted aggregation request that reads freed memory through server-side JavaScript. This could disclose server memory and affect availability.

  • SERVER-136182 (CVE-2026-120822 ): A user with backup and restore privileges could bypass authorization checks in a replication-related administrative command to read or relocate collections outside their permitted scope.

  • SERVER-136505 (CVE-2026-120824 ): A user permitted to write directly to time series bucket documents could trigger a use-after-free during validation, causing a crash or, in some circumstances, arbitrary code execution.

Medium severity

  • SERVER-132279 (CVE-2026-120809 ): An authenticated user could trigger a use-after-free through an aggregation pipeline with $unwind on a time series collection, exposing server memory or crashing the server. This requires a non-default server parameter for the slot-based execution (SBE) engine.

  • SERVER-135353 (CVE-2026-120811 ): A use-after-free in the classic query engine plan cache could expose server memory through diagnostic commands issued by an authenticated user. Under certain conditions, it could also crash the server.

  • SERVER-135737 (CVE-2026-120820 ): For operations carrying encrypted-field information, per-namespace statistics could accumulate without a limit. A user with basic read privileges could repeatedly send read requests referencing arbitrary namespaces, causing memory to remain allocated and slowing the affected code path. Reclaiming this memory requires a process restart.

For the complete upstream changelog, see MongoDB 8.0.37 Community Edition and MongoDB 8.0.38 Community Edition .

Tools packaged with this release

The following tool versions accompany this release:

Tool Base version Release notes
MongoDB Shell (mongosh) 2.14.1 Upstream release notes
MongoDB Database Tools 100.20.1 Upstream release notes