Executive brief
MongoDB failed to properly sanitize shard key values when processing change stream events with full document lookup. An authenticated user could craft malicious documents with special operator-shaped shard key values that are later interpreted as query operators rather than literal values, causing change stream consumers to receive incorrect documents or encounter fatal errors. This impacts applications relying on MongoDB change streams for real-time data synchronization and event processing.
Technical details
The vulnerability is an injection flaw in MongoDB's aggregation pipeline updateLookup feature for change streams. When a change stream event occurs on a sharded collection with the updateLookup full document mode enabled, the document's _id and shard key values are injected directly into a $match expression without proper escaping. An authenticated user can store documents with dollar-prefixed (operator-shaped) values in the shard key field, which are then interpreted as MQL operators during the post-image lookup query. This allows arbitrary query operators to be executed and can transform a point lookup into a multi-document lookup, returning incorrect post-image documents or causing non-resumable fatal errors in change stream consumers. The fix requires proper escaping of document keys before embedding them in $match expressions. The issue affects MongoDB versions prior to 7.0.41, 8.0.30, 8.2.13, 8.3.9, and 9.0.0-rc2.
Affected products
- MongoDB MongoDB Server before 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2
Timeline
- 2026-09-08: disclosed: CVE-2026-82060 published
- 2026-09-08: patched: Fixed in MongoDB 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, and later