RN-7.0.40-22 - #1163
Open
rasika-chivate wants to merge 22 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds documentation updates to publish release notes for Percona Server for MongoDB 7.0.40-22, wiring the new release into the MkDocs navigation, release-notes index, and PDF cover metadata.
Changes:
- Bumps the documented
releasevariable to 7.0.40-22 and adds a newdate.7_0_40entry. - Adds 7.0.40-22 to the MkDocs nav and release-notes index page.
- Introduces a new release-notes page at
docs/release_notes/7.0.40-22.mdand updates the PDF cover page to reference the new version/date.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| variables.yml | Updates the current release value and adds the new release date variable. |
| mkdocs-base.yml | Adds the new release-notes page to the site navigation. |
| docs/release_notes/index.md | Adds the new release entry to the release-notes index list. |
| docs/release_notes/7.0.40-22.md | Adds the new 7.0.40-22 release-notes page (currently a partial skeleton). |
| docs/_templates/pdf_cover_page.tpl | Updates PDF cover text for the new version/date. |
Suppressed comments (2)
docs/release_notes/7.0.40-22.md:40
- This is an empty list item, which renders as a blank bullet in the published release notes. Remove it (or replace it with actual content) so the section doesn’t contain a dangling bullet.
*
docs/release_notes/7.0.40-22.md:23
- The “Security fixes from upstream MongoDB” section is present but currently has no entries under any severity heading. Publishing an empty section is confusing for readers; please either populate it with the relevant CVEs/issues for 7.0.40 or remove the section until the content is ready.
## Security fixes from upstream MongoDB
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (7)
docs/release_notes/7.0.40-22.md:36
- These items have adjacent JIRA/CVE links without spacing/parentheses; this is inconsistent with other release notes and reduces readability. Use the same
...JIRA... (CVE...)formatting throughout the list.
- [SERVER-130481 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130481){:target="_blank"}[CVE-2026-18690 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18690){:target="_blank"}: Fixed an authorization issue where an authenticated user with limited database-level privileges could perform operations on protected system collections beyond their assigned permissions. This could allow the user to drop and recreate critical system collections without the required authorization.
- [SERVER-129994 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-129994){:target="_blank"}[CVE-2026-18693 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18693){:target="_blank"}: Fixed an issue in Percona Server for MongoDB’s handling of time series collections. An authenticated user with write access could insert certain documents. This could leave an internal data structure in an inconsistent state. A later insert into the affected bucket could access memory outside its intended bounds. This could cause a server crash, limited memory exposure, or memory corruption.
- [SERVER-130188 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130188){:target="_blank"}[CVE-2026-18694 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18694){:target="_blank"}: Fixed an issue in Percona Server for MongoDB’s geospatial query processing. An authenticated user with write access could store malformed geometry data. The server could later process this data without proper validation. A subsequent query could access memory outside its intended bounds. This could cause a server crash or expose a limited amount of process memory.
docs/release_notes/7.0.40-22.md:42
- These items have adjacent JIRA/CVE links without spacing/parentheses; align formatting with other release notes for consistent rendering/readability.
- [SERVER-129460 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-129460){:target="_blank"}[CVE-2026-18695 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18695){:target="_blank"}: Resolved an issue in Percona Server for MongoDB related to processing specific query predicates on time series collections with a `metaField`. An authenticated user with write access could unexpectedly terminate the server process, resulting in a denial-of-service.
- [SERVER-130139 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130139){:target="_blank"}[CVE-2026-18696 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18696){:target="_blank"}: Fixed an authorization bypass in the `applyOps` command. The namespace used for the permission check did not always match the namespace the operation actually ran against, so an authenticated user holding certain non-default privileges could drop or alter collections they were not authorized to touch. The command now resolves the target collection once and checks it against the caller's privileges before applying the operation.
- [SERVER-130110 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130110){:target="_blank"}[CVE-2026-18697 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18697){:target="_blank"}: Fixed an issue in the aggregation framework that could allow an unauthenticated user to terminate a `mongos` process by sending a specially crafted aggregation command. Exploitation could result in a denial of service and disrupt client connections routed through the affected `mongos` instance.
docs/release_notes/7.0.40-22.md:56
- These medium-severity items have adjacent JIRA/CVE links without spacing/parentheses; align formatting with other release notes for consistent rendering.
- [SERVER-130481 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130481){:target="_blank"}[CVE-2026-18698 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18698){:target="_blank"}: Fixed an authorization issue in MongoDB Server where an authenticated user with a limited database-scoped role could access protected system collections without the required privileges. This could expose collection metadata and, in some deployment configurations, allow unauthorized modification of system collection data.
- [SERVER-130481 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130481){:target="_blank"}[CVE-2026-18699 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18699){:target="_blank"}: Resolved an issue in MongoDB Server’s query planner where an authenticated user with **read-level privileges** could cause the server process to terminate by submitting a specially crafted query against a collection with a text index. This could result in a denial-of-service attack, disrupting connected clients and in-flight operations.
- [SERVER-130117 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130117){:target="_blank"}[CVE-2026-18700 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18700){:target="_blank"}: Resolved an issue in MongoDB Server’s geospatial validation where an authenticated user with write privileges could trigger invalid memory access through concurrent operations on a collection using a specific validator. This could cause the server process to crash, resulting in a denial-of-service.
docs/release_notes/7.0.40-22.md:62
- These medium-severity items have adjacent JIRA/CVE links without spacing/parentheses; use the same link formatting as other release notes for consistent rendering.
- [SERVER-130198 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130198){:target="_blank"}[CVE-2026-18702 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18702){:target="_blank"}: Resolved an issue in MongoDB Server where an authenticated user with limited database-scoped privileges could modify diagnostic logging settings at the server level. This could suppress diagnostic logging across the server or generate excessive log output, reducing the effectiveness of operational monitoring.
- [SERVER-130167 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130167){:target="_blank"}[CVE-2026-18708 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18708){:target="_blank"}: Resolved an issue in MongoDB Server’s JavaScript scripting engine where an authenticated user with write privileges could influence query execution for other users through a specially crafted stored value processed during internal maintenance. This could lead to incorrect query results or denial of service for operations on the same database. The impact is limited to the scripting engine sandbox and does not provide access to database, filesystem, or network resources.
- [SERVER-130544 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130544){:target="_blank"}[CVE-2026-18709 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18709){:target="_blank"}: Resolved an issue in MongoDB Server where an authenticated user with direct network access to a shard could improperly commit or abort an in-progress prepared transaction, bypassing the expected transaction coordination process. This could result in cross-shard data inconsistencies and violations of transaction atomicity.
docs/release_notes/7.0.40-22.md:48
- These items have adjacent JIRA/CVE links without spacing/parentheses, and there is a typo in “denial- of-service”. Use consistent
...JIRA... (CVE...)formatting and correct the hyphenation.
- [SERVER-130111 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130111){:target="_blank"}[CVE-2026-18701 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18701){:target="_blank"}: Resolved an issue in MongoDB Server’s query subsystem where an authenticated user with read privileges could cause `mongod` to terminate by submitting a specially crafted query filter. This could result in a denial- of-service.
- [SERVER-129618 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-129618){:target="_blank"}[CVE-2026-18705 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18705){:target="_blank"}: Resolved an issue in MongoDB Server’s Atlas Vector Search feature where an authenticated user with read access to one view could retrieve documents from another protected view over the same underlying collection. This was caused by insufficient validation of user-supplied fields when constructing internal search requests.
- [SERVER-130633 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130633){:target="_blank"}[CVE-2026-18712 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18712){:target="_blank"}: Resolved an issue in MongoDB Server’s Queryable Encryption maintenance operations where an authenticated user with privileges on one encrypted collection could modify or delete data belonging to another collection. This was caused by insufficient validation of internal metadata references before operations were performed on other namespaces.
docs/release_notes/7.0.40-22.md:30
- The JIRA and CVE links are missing a separator (and the CVE is not wrapped like other release notes), so they render as adjacent links with no spacing. Align this with the established format in
docs/release_notes/7.0.39-21.md(space + parentheses around the CVE link). Also add the missing{:target="_blank"}for the CVE link on the next item.
This issue also appears in the following locations of the same file:
- line 32
- line 38
- line 44
- line 52
- line 58
- [SERVER-130264 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130264){:target="_blank"}[CVE-2026-18691 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18691){:target="_blank"}: Fixed an issue in intra-cluster authentication where an attacker with access to cluster network traffic could influence the authentication mechanism used between replica set members. Under certain conditions, this could expose the cluster's shared internal credential in a less-protected form. An attacker who recovered this credential could use it to authenticate to nodes with internal **superuser** privileges.
### High severity
- [SERVER-129617 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-129617){:target="_blank"}[CVE-2026-18688 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18688): Fixed an issue where an authenticated user could pass a specially crafted numeric value to an aggregation pipeline stage, causing an out-of-bounds memory read. This could cause `mongod` to crash, resulting in a denial-of-service, and could potentially expose a limited amount of process memory.
variables.yml:7
variables.ymlstill pinsmongoshto 2.9.2, but the new 7.0.40-22 release notes listmongosh2.10.0. Since this variable is used in download URLs (e.g., tarball install instructions), leaving it at 2.9.2 will generate incorrect links for this release.
release: '7.0.40-22'
version: '7.0'
mongosh: '2.9.2'
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (17)
docs/release_notes/7.0.40-22.md:32
- The Jira and CVE links render as one contiguous label. Add the same separator used by the other release notes.
- [SERVER-129617 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-129617){:target="_blank"}[CVE-2026-18688 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18688): Fixed an issue in the aggregation framework where an authenticated user could provide a specially crafted numeric value to an aggregation pipeline stage and cause the server to read memory outside the expected bounds. This could crash `mongod` or expose a limited amount of process memory.
docs/release_notes/7.0.40-22.md:36
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-129994 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-129994){:target="_blank"}[CVE-2026-18693 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18693){:target="_blank"}: Fixed an issue in Percona Server for MongoDB’s handling of time series collections. An authenticated user with write access could insert certain documents. This could leave an internal data structure in an inconsistent state. A later insert into the affected bucket could access memory outside its intended bounds. This could cause a server crash, limited memory exposure, or memory corruption.
docs/release_notes/7.0.40-22.md:38
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130188 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130188){:target="_blank"}[CVE-2026-18694 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18694){:target="_blank"}: Fixed an issue in Percona Server for MongoDB’s geospatial query processing. An authenticated user with write access could store malformed geometry data. The server could later process this data without proper validation. A subsequent query could access memory outside its intended bounds. This could cause a server crash or expose a limited amount of process memory.
docs/release_notes/7.0.40-22.md:40
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-129460 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-129460){:target="_blank"}[CVE-2026-18695 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18695){:target="_blank"}: Fixed an issue in the processing of query predicates on time series collections with a `metaField`, where an authenticated user with write access could terminate the server process, resulting in a denial-of-service.
docs/release_notes/7.0.40-22.md:42
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130139 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130139){:target="_blank"}[CVE-2026-18696 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18696){:target="_blank"}: Fixed an authorization bypass in the `applyOps` command. The namespace used for the permission check did not always match the namespace the operation ran against, so an authenticated user with certain non-default privileges could drop or alter collections outside their permissions.
docs/release_notes/7.0.40-22.md:44
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130110 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130110){:target="_blank"}[CVE-2026-18697 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18697){:target="_blank"}: Fixed an issue in the aggregation framework where an unauthenticated user could terminate a `mongos` process by sending a specially crafted aggregation command. This could cause a denial-of-service and interrupt client connections routed through the affected `mongos` instance.
docs/release_notes/7.0.40-22.md:46
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130111 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130111){:target="_blank"}[CVE-2026-18701 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18701){:target="_blank"}: Resolved an issue in MongoDB Server’s query subsystem where an authenticated user with read privileges could cause `mongod` to terminate by submitting a specially crafted query filter. This could result in a denial-of-service.
docs/release_notes/7.0.40-22.md:48
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130633 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130633){:target="_blank"}[CVE-2026-18712 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18712){:target="_blank"}: Fixed an authorization issue in Queryable Encryption maintenance operations where a user with privileges on one encrypted collection could modify or delete data in another collection. The issue was caused by insufficient validation of internal metadata references before operating on other namespaces.
docs/release_notes/7.0.40-22.md:52
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130266 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130266){:target="_blank"}[CVE-2026-18699 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18699){:target="_blank"}: Resolved an issue in MongoDB Server’s query planner where an authenticated user with **read-level privileges** could cause the server process to terminate by submitting a specially crafted query against a collection with a text index. This could result in a denial-of-service attack, disrupting connected clients and in-flight operations.
docs/release_notes/7.0.40-22.md:54
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130117 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130117){:target="_blank"}[CVE-2026-18700 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18700){:target="_blank"}: Fixed an issue in geospatial validation where an authenticated user with write privileges could trigger invalid memory access through concurrent operations on a collection configured with a geospatial validator. This could cause the server process to crash, resulting in a denial of service. Users should review collections that use geospatial validation rules.
docs/release_notes/7.0.40-22.md:56
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130198 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130198){:target="_blank"}[CVE-2026-18702 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18702){:target="_blank"}: Fixed an issue where an authenticated user with limited database-scoped privileges could change diagnostic logging settings at the server level. This could suppress diagnostic logging across the server or generate excessive log output, reducing the effectiveness of operational monitoring.
docs/release_notes/7.0.40-22.md:58
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130167 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130167){:target="_blank"}[CVE-2026-18708 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18708){:target="_blank"}: Fixed an issue in the JavaScript scripting engine where an authenticated user with write privileges could influence query execution for other users through a specially crafted stored value processed during internal maintenance. This could return incorrect query results or cause a denial of service for operations on the same database. The issue is confined to the scripting engine sandbox and does not grant access to filesystem or network resources.
docs/release_notes/7.0.40-22.md:60
- The Jira and CVE labels are concatenated in the rendered release note; delimit the CVE reference.
- [SERVER-130544 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130544){:target="_blank"}[CVE-2026-18709 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18709){:target="_blank"}: Fixed an issue in sharded clusters where an authenticated user with direct network access to a shard could commit or abort a prepared transaction without going through the expected transaction coordination process. This could cause cross-shard data inconsistencies, affect the cluster clock, and violate transaction atomicity.
docs/release_notes/7.0.40-22.md:28
- The Jira and CVE links render as one contiguous label, making the two identifiers difficult to distinguish. Separate the CVE in parentheses, consistent with the preceding release notes.
This issue also appears in the following locations of the same file:
- line 32
- line 36
- line 38
- line 40
- line 42
- ...and 8 more
- [SERVER-130264 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130264)[CVE-2026-18691 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18691){:target="_blank"}: Fixed an issue in intra-cluster authentication where an attacker with access to cluster network traffic could influence the authentication mechanism used between replica set members. Under certain conditions, this could expose the cluster's shared internal credential in a less-protected form. An attacker who recovered this credential could use it to authenticate to nodes with internal **superuser** privileges.
docs/release_notes/7.0.40-22.md:34
- These three external-link labels run together without separators, obscuring the Jira/CVE boundaries.
- [SERVER-130481 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-130481){:target="_blank"}[CVE-2026-18690 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18690)[CVE-2026-18698 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-18698){:target="_blank"}: Fixed an authorization issue where an authenticated user with limited database-level privileges could perform operations on protected system collections beyond their assigned permissions. This could allow the user to drop and recreate critical system collections without the required authorization.
docs/release_notes/7.0.40-22.md:68
- The new
mongoshchangelog fragment drops the dots from the version, unlike the established upstream-link form (#v2.9.2in7.0.39-21.md:100). This prevents the link from targeting the 2.10.0 section.
| MongoDB Shell (`mongosh`) | 2.10.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2100){:target="_blank"} |
docs/release_notes/7.0.40-22.md:24
- Remove the stray space before the period so punctuation follows the link normally.
This release fixes vulnerabilities inherited from upstream MongoDB. The severity categories below follow the upstream [CVSS scores :octicons-link-external-16:](https://nvd.nist.gov/vuln-metrics/cvss){:target="_blank"} .
vorsel
approved these changes
Aug 17, 2026
sandraromanchenko
requested changes
Aug 17, 2026
Co-authored-by: Sandra Romanchenko <53295797+sandraromanchenko@users.noreply.github.com>
Copilot stopped reviewing on behalf of
rasika-chivate due to an error
August 17, 2026 14:28
sandraromanchenko
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
"Create Release notes for PSMDB version 7.0.40-22."