Database teams woke up to another MongoDB security scare late last year. A flaw dubbed Mongobleed let attackers pull sensitive data from server memory. No login needed. Just network access and default compression settings. The incident, detailed by MongoDB on Dec. 29, 2025, sent operators scrambling.
But one vendor moved faster than most. Percona didn’t just patch its Server for MongoDB. It rolled out a practical way for users to check their tools on day one of any new CVE. The approach relies on software bills of materials. Simple. Effective. And now standard in two key Percona utilities.
Oleksandr Miroshnychenko explained the change in a post published today. Starting with Percona Backup for MongoDB 2.15.0 and Percona ClusterSync for MongoDB 0.9.0, every release ships a CycloneDX 1.6 SBOM in JSON format. Tarballs. RPMs. DEBs. Docker images. All of them. “You can now answer ‘Is my database tooling affected by this CVE?’ in seconds instead of days,” he wrote. (Percona Blog, July 24, 2026)
The SBOMs come generated by Syft. They capture components from the built binary and file tree. No extra steps. No configuration toggles. Users scan them with familiar tools such as Trivy or Grype. Results appear immediately.
From Panic to Precision
Consider the last big MongoDB vulnerability. CVE-2025-14847, known as Mongobleed, carried a CVSS score of 8.7. It allowed unauthenticated remote attackers to read uninitialized heap memory when zlib compression was enabled. Bitsight estimated more than 87,000 servers sat exposed globally. Active exploitation followed within days of disclosure. (Bitsight, Dec. 29, 2025)
Percona responded with patches for all supported Percona Server for MongoDB branches. Radoslaw Szulgo outlined the fixes in early January. Affected releases stretched back years, including end-of-life versions. The company even shipped an extra patch for 6.0.27-21 on Jan. 12, 2026, despite that branch reaching end of life. “We strongly recommend upgrading,” Szulgo stated. As a temporary measure, teams could disable zlib compression. (Percona Blog, Jan. 6, 2026)
Yet patching the core server only solved half the problem. What about the surrounding tools? Backup agents. Cluster management utilities. Monitoring components. Each carries its own dependency tree. Each could introduce fresh risks. Traditional methods required waiting for vendor statements or running lengthy scans. Days could pass. Exposure grew.
Percona’s SBOM strategy changes that timeline. Operators grab the JSON file from their installed package. They point Trivy at it. High and critical issues surface at once. The same file works in CI pipelines. Security teams can block vulnerable images before they reach production. And because the SBOM travels with every artifact, consistency holds across bare metal, virtual machines, containers and Kubernetes.
Docker users gain extra flexibility. The images contain both an embedded SBOM for the application layers and an OCI-attached SBOM that includes the base operating system. A single Trivy command with the –sbom-sources oci flag pulls the full picture. Oras lets users inspect attached references manually. Simple commands replace guesswork.
But the feature arrives amid broader MongoDB security headaches. Just last month Percona issued another advisory. CVE-2026-9740 and CVE-2026-11933, both high-severity memory safety issues, hit Percona Server for MongoDB 7.0 and 8.0. One required no credentials. The other needed authentication yet still posed serious risk. Patches landed between June 23 and 25, 2026. Szulgo again led the communication. He advised teams to restrict network listeners, disable JavaScript execution where possible, and audit user roles. (Percona Blog, June 17, 2026)
These repeated disclosures highlight a pattern. Memory safety flaws keep appearing. Compression libraries, BSON handling, JavaScript engines. All become vectors. Enterprises running self-managed MongoDB face the brunt. Atlas customers receive automated updates. Everyone else must act manually. And they must act fast.
Percona’s move toward transparent SBOMs gives those operators an edge. The documents list exact versions of libraries, Go modules, and system components. When a new CVE drops for, say, a common compression library or a base image, teams know within minutes whether their Percona tools match the vulnerable fingerprint. No more digging through release notes. No more assumptions.
Future plans include VEX statements. These will clarify which reported CVEs have been fixed, which remain not applicable, and which actually require attention. The addition will shrink alert fatigue even further. For now, the SBOM alone delivers immediate value.
Production environments rarely stand still. New CVEs emerge weekly. Some prove exploitable within hours. Others linger as theoretical risks. Either way, teams cannot afford lag. Percona’s implementation removes that lag for its MongoDB-adjacent tools. The company ships the same capability across its MySQL and PostgreSQL offerings too, though today’s announcement focuses on the MongoDB side.
Database administrators have grown tired of vendor promises. They want data. They want speed. And they want to avoid yet another late-night patching session caused by an overlooked dependency. Percona’s SBOMs hand them exactly that. Scan. Decide. Move. The process takes seconds.
Of course, SBOMs alone do not secure a deployment. Network segmentation still matters. Credential rotation after suspected leaks remains essential. Regular upgrades cannot wait. Yet having accurate component intelligence on day one removes one major source of uncertainty. In an industry where uncertainty breeds downtime, that counts.
Percona built the feature without fanfare. No marketing slogans. Just practical files added to existing packages. The approach mirrors the company’s long-standing focus on open-source transparency. Users can inspect the SBOMs themselves. They can feed them into any compliant scanner. Lock-in stays minimal.
As more organizations adopt supply-chain security standards, expect similar requirements from auditors and compliance teams. SBOM readiness could soon shift from nice-to-have to mandatory. Percona users running the latest PBM and PCSM versions already meet that bar. Others will need to upgrade.
The timing feels deliberate. Mongobleed exposed how memory leaks in core database code can ripple outward. Subsequent advisories in 2026 reinforced the message. Tools that surround the database matter just as much as the database itself. Percona’s answer equips teams to evaluate those tools without delay.
So the next time a critical CVE appears in a popular library, affected Percona customers won’t spend hours tracing impact. They’ll run one command. They’ll see the truth. And they’ll know what to do. That speed can mean the difference between contained risk and widespread exposure.
WebProNews is an iEntry Publication