CVE-2026-82059

MediumCVSS 6.5/10Last modified Sep 16, 2026

Description

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 8.3.0, < 8.3.9; >= 8.0.0, < 8.0.30; >= 7.0.0, < 7.0.41

References

https://jira.mongodb.org/browse/SERVER-130571Vendor Advisory, Issue Tracking

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-82069.8The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeo CVE-2026-820605.4In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specia CVE-2026-820618.1A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges CVE-2026-820625.5A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the a CVE-2026-820635.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of servi CVE-2026-820647.5A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set mem CVE-2026-820656.5A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges t CVE-2026-820668.1A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read CVE-2026-820678.1Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to r CVE-2026-820686.5A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sendi CVE-2026-820696.5A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredact CVE-2026-82077.0Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://githu