CVE-2026-82068

Awaiting Analysis Awaiting Analysis - Queue

MongoDB Server Persistent Fatal Assertion Crash via Retryable Writes

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: MongoDB, Inc.

Description

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82068

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB Server allows an authenticated user with write privileges to crash the server by sending specially crafted retryable write commands. The crash is persistent and stored durably, causing the server to repeatedly crash on restart. This can also spread to other nodes in a sharded cluster, requiring manual intervention to restore service.

Detection Guidance

Detecting this vulnerability requires monitoring for MongoDB server crashes caused by retryable write commands. Check server logs for fatal assertion errors or repeated crashes on restart. Use commands like 'mongod --version' to verify MongoDB version and 'journalctl -u mongod' (Linux) or 'Get-EventLog -LogName Application -Source MongoDB' (Windows) to inspect crash logs.

Impact Analysis

If exploited, this vulnerability can cause repeated server crashes, leading to downtime and loss of service availability. It may disrupt database operations, affect data access, and require manual recovery efforts to bring the system back online.

Mitigation Strategies

Immediately update MongoDB to the latest patched version. If updating is not possible, disable retryable writes by setting 'enableRetryableWrites=false' in the MongoDB configuration. Restrict write privileges to trusted users only and monitor for unusual retryable write activity.

Hi! I’m here to help you understand CVE-2026-82068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70