Executive brief
MongoDB Server contains a privilege escalation vulnerability in the applyOps command that allows authenticated users with elevated internal privileges to bypass a disabled security feature. By exploiting this bypass, attackers can execute container operations and write directly to the database's internal storage tables, potentially corrupting metadata or compromising other collections' data. This affects production deployments where these operations are disabled by default for security reasons.
Technical details
The vulnerability is an authorization bypass in MongoDB Server's applyOps command. An authenticated user with elevated internal replication privileges can specify an internal replication mode value that is not intended to be client-selectable, bypassing the disabled feature gate that prevents container operations. The authorization check for these operations validates only the operation's namespace but not the actual storage target, enabling writes to unrelated internal metadata or arbitrary storage tables through the storage engine. This allows direct modification of internal storage despite authorization controls. The issue is fixed in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later.
Affected products
- MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0
Timeline
- 2026-09-08: disclosed: CVE-2026-82062 published
- 2026-09-08: patched: Fixed in MongoDB Server 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later