Access Control Misconfiguration in MongoDB Server

CVE-2026-82059

What is CVE-2026-82059?

A vulnerability in MongoDB Server arises when an internal aggregation expression is improperly exposed, allowing any authenticated user to access it without the necessary restrictions. By manipulating index specifications within this expression, a user with read-only permissions can cause assertion failures in the index key generation process. In certain configurations, this failure can lead to the termination of the mongod service, resulting in denial of service for all connected clients. This incident emphasizes the critical need for robust access controls to safeguard against potential disruptions.

References