CVE-2026-30833

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.

• CWE-943

• https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-hgq6-9jg2-wf3fVendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30828Wallos is an open-source, self-hostable personal subscriptio…7.5
• CVE-2026-30829Checkmate is an open-source, self-hosted tool designed to tr…5.3
• CVE-2026-3083GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execu…8.8
• CVE-2026-30830Defuddle cleans up HTML pages. Prior to version 0.9.0, the _…6.1
• CVE-2026-30831Rocket.Chat is an open-source, secure, fully customizable co…9.8
• CVE-2026-30832Soft Serve is a self-hostable Git server for the command lin…9.1
• CVE-2026-30834PinchTab is a standalone HTTP server that gives AI agents di…7.5
• CVE-2026-30835Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-30836Step CA is an online certificate authority for secure, autom…10
• CVE-2026-30837Elysia is a Typescript framework for request validation, typ…7.5
• CVE-2026-30838league/commonmark is a PHP Markdown parser. Prior to version…6.1
• CVE-2026-30839Wallos is an open-source, self-hostable personal subscriptio…4.3