Privilege Escalation in MongoDB Server via Bypassed Feature Gate

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: MongoDB, Inc.

Description

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82062

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command. By using an internal replication mode value not meant for client selection, they can execute container operations that are normally disabled in production. This enables direct writes to internal storage tables, bypassing authorization checks that only validate the operation's namespace, not the storage target.

Impact Analysis

An attacker with elevated privileges could exploit this to write arbitrary data to internal MongoDB storage tables, potentially corrupting data, bypassing security controls, or accessing sensitive information. This could lead to unauthorized modifications, data leaks, or system instability.

Mitigation Strategies

Apply the latest MongoDB Server patch or update to a version that fixes this issue. Restrict authenticated user privileges to the minimum required for their roles. Monitor logs for suspicious applyOps command usage with internal replication modes.

Hi! I’m here to help you understand CVE-2026-82062. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70