Executive brief
MongoDB Server incorrectly exposed an internal aggregation expression to all authenticated users, even those with only read-only access. An attacker with minimal database permissions can craft a malformed index specification to crash the database server, disrupting service for all connected users and applications.
Technical details
The $_internalIndexKey aggregation expression was registered with AllowedWithClientType::kAny instead of AllowedWithClientType::kInternal, making it accessible to any authenticated user rather than restricting it to internal cluster operations. An authenticated user with read-only privileges can exploit this by crafting a malformed index specification within the expression, triggering an assertion failure in the index key generation code path. In certain build configurations, this assertion failure causes the mongod process to terminate, resulting in a denial-of-service condition affecting all connected clients. Patches are available in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc1, and 9.1.0-rc0.
Affected products
- MongoDB Server 7.0 before 7.0.41, 8.0 before 8.0.30, 8.2 before 8.2.13, 8.3 before 8.3.9, 9.0-rc before 9.0.0-rc1
Timeline
- 2026-09-08: disclosed: CVE-2026-82059 published
- 2026-09-20: patched: Fix versions released: 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc1, 9.1.0-rc0