# CVE-2026-82062: MongoDB Server feature gate bypass in applyOps command

Source: https://junglewise.ai/threats/cve-2026-82062-mongodb-server-feature-gate-bypass-in-applyops-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82062 · Severity: medium · CVSS 5.5 · Published 2026-09-08

MongoDB Server contains a privilege escalation vulnerability in the applyOps command that allows authenticated users with elevated internal privileges to bypass a disabled security feature. By exploiting this bypass, attackers can execute container operations and write directly to the database's internal storage tables, potentially corrupting metadata or compromising other collections' data. This affects production deployments where these operations are disabled by default for security reasons.

Technologies: [MongoDB](https://junglewise.ai/threats/technologies/mongodb). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-82062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82062 being exploited in the wild.

**How severe is CVE-2026-82062?** Medium severity, with a CVSS score of 5.5, published 8 September 2026.

**Which products and versions are affected?** MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0.

**Is there a fix for CVE-2026-82062?** A patch was published on 2026-09-08: Fixed in MongoDB Server 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82062 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82062?** Check whether you run MongoDB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in MongoDB Server's applyOps command. An authenticated user with elevated internal replication privileges can specify an internal replication mode value that is not intended to be client-selectable, bypassing the disabled feature gate that prevents container operations. The authorization check for these operations validates only the operation's namespace but not the actual storage target, enabling writes to unrelated internal metadata or arbitrary storage tables through the storage engine. This allows direct modification of internal storage despite authorization controls. The issue is fixed in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later.

## Affected products

- MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0

## Timeline

- 2026-09-08: disclosed: CVE-2026-82062 published
- 2026-09-08: patched: Fixed in MongoDB Server 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later

## References

- [https://jira.mongodb.org/browse/SERVER-131138](https://jira.mongodb.org/browse/SERVER-131138)

## Related threats

- [MongoDB replica-set denial of service via unreclaimed wait records](https://junglewise.ai/threats/cve-2026-120828-a-replica-set-database-server-node-does-not-limit-or-reclaim)
- [MongoDB privilege escalation via change stream showSystemEvents](https://junglewise.ai/threats/cve-2026-120816-a-user-with-basic-read-tier-database-privileges-can-use-an)
- [MongoDB macOS TLS certificate validation bypass for IPv6](https://junglewise.ai/threats/cve-2026-120808-an-issue-exists-in-mongodb-s-macos-tls-client-implementation)
- [MongoDB resource leak in SSPI Kerberos authentication handler](https://junglewise.ai/threats/cve-2026-120804-a-flaw-exists-in-the-server-side-sspi-kerberos-authentication)
- [MongoDB use-after-free in SBE window function accumulator](https://junglewise.ai/threats/cve-2026-120803-a-use-after-free-issue-exists-in-mongodb-s-sbe-slot-based)