MongoDB Server Crash via Aggregation Parameter Misconfiguration

Publication date: 2026-06-09

Last updated on: 2026-06-15

Assigner: MongoDB, Inc.

Description

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-15

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-28

NVD

CVE-2026-9747

EUVD

EUVD-2026-35863

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.35 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.24 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.10 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Impact Analysis

The vulnerability can cause the MongoDB server to crash during aggregation operations, potentially leading to denial of service and disruption of database availability.

Executive Summary

This vulnerability occurs when adding the parameters fromRouter:true and runtimeConstants.userRoles causes aggregation operations to crash the MongoDB server.

Hi! I’m here to help you understand CVE-2026-9747. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70