CVE-2026-4147 describes an information disclosure vulnerability in MongoDB Server’s filemd5 command. An authenticated user possessing the read role can issue specially crafted filemd5 commands that cause the server to read portions of uninitialized stack memory. This flaw results in the unintended leakage of data that resides on the stack at the time of the command’s execution, such as passwords, cryptographic keys, or other sensitive information. The weakness is identified as CWE-457, Uninitialized Variable.

Affected systems are MongoDB Inc: MongoDB Server installations that provide the filemd5 command to users with a read role. No specific versions are listed in the CNA data, so the exact impacted versions are unknown; any system that implements the filemd5 operation remains potentially vulnerable until confirmed patches are applied.

The CVSS base score of 7.1 indicates moderate to high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The attack requires legitimate read‑role authentication, implying an insider or compromised account could leverage the flaw. Because no official fix or workaround is disclosed, the risk is mitigated primarily through applying vendor updates when they become available or limiting the read role’s ability to invoke filemd5.