Executive brief
MongoDB Server contains a privilege escalation flaw that allows authenticated users with limited database-scoped permissions to drop and recreate critical system collections they should not have access to. An attacker with basic database credentials could corrupt system metadata or perform unauthorized administrative actions, compromising database integrity and security controls.
Technical details
The vulnerability is a privilege escalation issue affecting MongoDB Server's authorization checks for system collections. An authenticated user assigned a limited database-scoped role can bypass authorization restrictions and perform privileged operations against protected system collections, including dropping and recreating them. The root cause involves improper validation of namespace parsing in CommandHelpers::parseNsFromCommand, which fails to correctly restrict operations on system resources. Attack requires valid authentication credentials but no elevated role permissions. An attacker can compromise critical system metadata, potentially leading to data loss or security policy bypass. Patches are available in MongoDB versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Fixed in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0