Patches Issued for MongoBleed as Ransomware Groups Target Flaw to Steal Data
Tens of thousands of internet-exposed MongoDB databases are at risk as attackers actively target a critical vulnerability in the software to steal sensitive data.
See Also: Securing AI by Design: Building Trustworthy AI at Scale
Tracked as CVE-2025-14847, the vulnerability has been dubbed “MongoBleed” for its ability to bleed vulnerable databases of their secrets. The flaw exists in every version of the document-oriented database software released since 2017.
The vulnerability exists in MongoDB’s implementation of the zlib compression and decompression software. “When compression is enabled – which it often is for performance – an attacker can craft connections that cause the server to leak chunks of its memory in responses,” said security researcher Eric Capuano.
“Attackers can exploit this to extract sensitive information from MongoDB servers, including user information, passwords, API keys and more,” simply by “sending malformed network packets,” said researchers at OX Security, who first published full technical details of the flaw.
With enough time, an attacker could also grab a full copy of any self-hosted, vulnerable database, they said.
Open-source MongoDB software is widely used, including by large organizations across all sectors, including financial services, pharmaceuticals, retail, automotive and the government.
The Shadowserver Foundation said its internet scans on Monday counted 74,854 vulnerable, unpatched versions of MongoDB – out of a total of 78,725 internet-exposed MongoDB instances.
The greatest number existed in China, which accounted for 16,800 IP addresses, followed by the United States with 13,300, Germany with 7,200 and France with 5,100.
Shadowserver said it’s directly notifying some organizations that it has been able to identify. “If you receive an alert from us, check for compromise,” it said. Experts also warned that internal servers, even if not internet-exposed, are at risk if attackers are able to breach a network and move laterally.
The eponymously named company that develops MongoDB first issued a public alert about the flaw on Dec. 19, alongside patches for anyone self-hosting one of the most recent six releases of the open-source software. Older versions of the software will go unpatched. “We strongly suggest you upgrade immediately,” said New York-based MongoDB Inc., the publicly traded firm that develops the open-source software and sells commercial support. “If you cannot upgrade immediately, disable zlib compression on the MongoDB Server.”
The value of the company’s stock dropped 2.9% on Monday amid reports that MongoBleed was being actively exploited. The company counts firms such as Coinbase, Epic Games, NASA, Novo Nordisk, Toyota, Verizon, Victoria’s Secret and Volkswagen as customers.
MongoDB recommends multiple security controls for self-hosted deployments, including enabling access control and enforcing authentication, although these are optional.
“While authentication is available for MongoDB, in many instances this authentication is not enabled,” the Shadowserver Foundation said.
Patched versions of MongoDB are 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30. The original vulnerability listing stated that version 8.2.3 contained the vulnerability, but the maintainers have clarified that the version does have the fix.
The vulnerability also exists in three previous MongoDB Server releases – versions 4.2, 4.0 and 3.6 – for which no patches have been released.
“This patched security vulnerability in the MongoDB Server products (Community and Enterprise) is not a breach or compromise of MongoDB, MongoDB Atlas (our managed MongoDB Server offering) or our systems,” MongoDB CTO Jim Scharf said in a Monday blog post.
The Atlas versions of MongoDB managed by the company have been patched and don’t appear to have been exploited.
A timeline published by MongoDB says the company’s security team first detected the flaw on Dec. 12, developed and tested a fix, began rolling it out on Dec. 15, and patched most of its self-managed Atlas instances by Dec. 17. The company published a public security alert and patch for the flaw on Dec. 19.
Security researcher Joe Desimone published a proof-of-concept exploit for the flaw on Thursday, after which researchers reported seeing attacks targeting the vulnerability.
Desimone called the exploit MongoBleed owing to it being “reminiscent of HeartBleed.” That was the nickname for a vulnerability in OpenSSL, an open-source implementation of the SSL and TLS protocols that’s used to secure data sent between clients and servers, discovered and patched in 2014.
British cybersecurity expert Kevin Beaumont said in a Saturday blog post that he has verified that the POC exploit works as advertised. “You can just supply an IP address of a MongoDB instance and it’ll start ferreting out in memory things such as database passwords (which are plaintext), AWS secret keys, etc. The exploit specifically looks for those class of credentials and secrets, too,” he said.
Active Exploitation Underway
Cybersecurity agencies in Australia and the U.S. warned Monday that the vulnerability is being actively exploited globally by attackers. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog, setting a Jan. 19 deadline for federal civilian agencies to apply mitigations or discontinue use of the product.
To help security teams identify for signs of attempted or successful MongoBleed exploits, Capuano on Saturday published a CVE-2025-14847 “artifact” for the open-source Velociraptor digital forensics and incident response tool, which is designed to collect and analyze logs from software such as MongoDB.
Capuano said his artifact is designed to detect when attackers attempt to use the POC exploit that’s been published. If attackers modify that PoC or take steps to disguise their behavior, his artifact might not detect it.
Beaumont on Monday said ransomware groups have been attempting to exploit the vulnerability at scale, using the POC mongobleed.py script published by Desimone, and he expects to see more widespread exploitation of the flaw, given the simplicity with which it can be compromised.
The good news is patches are available and mitigation advice is readily accessible. “Keep calm and patch internet-facing assets,” Beaumont said.