Crafted cross-shard merge aggregation crashes MongoDB Server
CVE-2026-9747

7.1HIGH

Key Information:

What is CVE-2026-9747?

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

MongoDB Server 8.3.0 < 8.3.3

MongoDB Server 8.2.0 < 8.2.10

MongoDB Server 8.0.0 < 8.0.24

Score:

7.1

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

CVE-2026-9747 Data