Denial of Service Vulnerability in MongoDB Server's Storage Engine
CVE-2026-82065

7.1HIGH

Key Information:

Vendor

Mongodb
Status
Mongodb Server
Vendor
CVE Published:
8 September 2026

What is CVE-2026-82065?

A security flaw within the MongoDB Server's storage engine integration layer allows authenticated users with collection creation privileges to induce a persistent denial of service. This vulnerability arises from inadequate validation of user-supplied storage configuration options, enabling harmful values to be saved into durable metadata. When this corrupted metadata is accessed during subsequent diagnostic operations, it triggers a fatal assertion failure. The issue persists across server restarts and may replicate to other members of the cluster, mandating manual intervention by operators to restore normal service operations.

Affected Version(s)

MongoDB Server 8.3.0 < 8.3.9

MongoDB Server 8.0.0 < 8.0.30

MongoDB Server 7.0.0 < 7.0.41

References

https://jira.mongodb.org/browse/SERVER-131420

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.