Executive brief
MongoDB is a widely-used database that stores application data. This vulnerability allows an authenticated database user with standard write permissions to crash the MongoDB server by creating a collection with an invalid storage configuration option. Because the malicious configuration persists across server restarts, an attacker can cause repeated outages until administrators manually fix the corrupted collection, disrupting business operations and data availability.
Technical details
The vulnerability is a type-confusion flaw in MongoDB's WiredTiger storage engine layer. The root cause is that WiredTigerRecordStore fails to enforce the required value_format=u suffix when processing a custom configString parameter during collection creation, allowing an authenticated readWrite-privileged user to supply an incompatible storage configuration. When documents are subsequently read from the misconfigured collection, the mismatch between expected and actual data format causes corrupted memory interpretation, leading to a mongod process crash. The malicious configuration persists across server restarts, requiring manual operator intervention to remediate. Patches are available in MongoDB versions 8.2.13, 8.3.9, and 9.1.0-rc0 or later.
Affected products
- MongoDB MongoDB Server prior to 8.2.13, 8.3.9, and 9.1.0-rc0
Timeline
- 2026-09-08: disclosed: CVE-2026-82057 published
- 2026-07-07: patched: Fix resolved in JIRA
- 2026-09-22: other: JIRA ticket updated