CVE-2026-30833 Rocket.Chat: NoSQL injection in the EE ddp-streamer-service

Medium 6.9 Published 6 Mar 2026 Updated 9 Mar 2026

Unauthenticated attackers can inject MongoDB operators into login queries to bypass authentication and take over accounts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-30833?

CVE-2026-30833 is a medium-severity SQL injection vulnerability in Rocket.chat Rocket.chat, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows unauthenticated attackers to manipulate MongoDB queries during authentication. The vulnerability is located in the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation. An attacker can inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.

Weakness: CWE-943

Which versions are affected by CVE-2026-30833?

It affects 1 product.

Products include Rocket.chat Rocket.chat.

How do I fix CVE-2026-30833?

No fix has been published for CVE-2026-30833 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-30833 being exploited?

There is no known exploitation of CVE-2026-30833 in the wild and no public exploit code.

All Rocket.chat Rocket.chat vulnerabilities

Sources

Also known as GHSA-hgq6-9jg2-wf3f.