Authorization Flaw in MongoDB Server's Sharded Cluster Router

CVE-2026-104005

What is CVE-2026-104005?

A security vulnerability in the write routing component of the MongoDB Server sharded cluster router allows authenticated users with write privileges on standard collections to execute bulk write operations targeting internal system namespaces without proper authorization checks. This oversight means that unauthorized write actions could be accepted by the router, potentially compromising data integrity depending on the targeted namespace.

References