Is CVE-2026-82057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82057 being exploited in the wild.

How severe is CVE-2026-82057?

Medium severity, with a CVSS score of 6.5, published 8 September 2026.

Which products and versions are affected?

MongoDB Server prior to 8.2.13, 8.3.9, and 9.1.0-rc0.

Is there a fix for CVE-2026-82057?

A patch was published on 2026-07-07: Fix resolved in JIRA Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82057 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82057?

Check whether you run MongoDB or MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82057: MongoDB readWrite privilege DoS via WiredTiger misconfiguration

CVE-2026-82057 · Severity: medium · CVSS 6.5 · Published 2026-09-08

MongoDB is a widely-used database that stores application data. This vulnerability allows an authenticated database user with standard write permissions to crash the MongoDB server by creating a collection with an invalid storage configuration option. Because the malicious configuration persists across server restarts, an attacker can cause repeated outages until administrators manually fix the corrupted collection, disrupting business operations and data availability.

Technologies: MongoDB, MongoDB Server. Vendors: MongoDB.

Quick answers

Is CVE-2026-82057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82057 being exploited in the wild.
How severe is CVE-2026-82057?: Medium severity, with a CVSS score of 6.5, published 8 September 2026.
Which products and versions are affected?: MongoDB Server prior to 8.2.13, 8.3.9, and 9.1.0-rc0.
Is there a fix for CVE-2026-82057?: A patch was published on 2026-07-07: Fix resolved in JIRA Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82057 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82057?: Check whether you run MongoDB or MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a type-confusion flaw in MongoDB's WiredTiger storage engine layer. The root cause is that WiredTigerRecordStore fails to enforce the required value_format=u suffix when processing a custom configString parameter during collection creation, allowing an authenticated readWrite-privileged user to supply an incompatible storage configuration. When documents are subsequently read from the misconfigured collection, the mismatch between expected and actual data format causes corrupted memory interpretation, leading to a mongod process crash. The malicious configuration persists across server restarts, requiring manual operator intervention to remediate. Patches are available in MongoDB versions 8.2.13, 8.3.9, and 9.1.0-rc0 or later.

Affected products

MongoDB MongoDB Server prior to 8.2.13, 8.3.9, and 9.1.0-rc0

Timeline

2026-09-08: disclosed: CVE-2026-82057 published
2026-07-07: patched: Fix resolved in JIRA
2026-09-22: other: JIRA ticket updated

References

https://jira.mongodb.org/browse/SERVER-130495

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.