CVE-2026-82065

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in MongoDB Server Storage Engine

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: MongoDB, Inc.

Description

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-82065

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. It occurs due to insufficient validation of storage configuration options, which can corrupt metadata. This corruption triggers fatal assertion failures during diagnostic operations, persists across server restarts, and replicates to other cluster members.

Detection Guidance

Detecting this vulnerability requires checking for corrupted storage metadata in MongoDB. Monitor server logs for fatal assertion failures during diagnostic operations. Use commands like 'mongod --repair' to scan and repair metadata issues. Check for persistent errors in logs after server restarts.

Impact Analysis

This vulnerability can lead to service disruption by causing persistent denial of service. Affected systems may crash repeatedly due to corrupted metadata, requiring manual intervention to restore normal operation. The issue can spread to other servers in a cluster, amplifying the impact.

Mitigation Strategies

Apply the latest MongoDB security patch immediately. Restrict collection creation privileges to trusted users. Disable diagnostic operations that read storage metadata until patched. Monitor cluster members for replication of corrupted metadata and manually intervene if detected.

Hi! I’m here to help you understand CVE-2026-82065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70