Insufficient Validation Vulnerability Affecting MongoDB by MongoDB Inc.

CVE-2026-82060

What is CVE-2026-82060?

In MongoDB, a vulnerability exists due to inadequate validation of shard key values during the insertion of documents. This allows authenticated users to insert documents with specially crafted, operator-shaped objects as shard key values within sharded collections. When these values are processed during change stream events using the updateLookup full document mode, they can be embedded into internal post-image lookup queries without proper sanitization. Consequently, this leads to the potential misinterpretation of these values as query operators instead of literal equality values, resulting in incorrect post-image documents or non-resumable fatal errors for change stream consumers.

References