Executive brief
A security flaw in MongoDB Server's routing service (mongos) allows a user with permission to stop database queries in one database to incorrectly stop queries in other databases. This could allow a malicious or unauthorized user to disrupt business operations by terminating active data searches or reports being run by other employees. While it does not allow data to be stolen, it can cause service instability and performance issues across different parts of the organization's data infrastructure.
Technical details
An incorrect authorization check (CWE-863) exists in the 'mongos' killCursors command handler. The vulnerability occurs because the handler validates the 'killAnyCursor' action against the client-supplied request namespace rather than the cursor's actual associated namespace. An authenticated attacker with low privileges (specifically cursor termination rights on at least one namespace) can exploit this to terminate active cursors across different databases, leading to a denial-of-service for ongoing query operations. This issue specifically affects 'mongos' instances; 'mongod' is not affected as it correctly validates against the cursor's stored namespace. Fixes are available in MongoDB Server versions 7.0.39, 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-06-03: other: Issue reported internally in Jira
- 2026-07-22: disclosed: CVE published