Executive brief
MongoDB Server contains a flaw in how it validates storage engine configuration options during collection creation. An authenticated user can submit specially crafted configuration values that get permanently stored in the database metadata. When the server later reads this corrupted metadata, it crashes and remains unavailable until an operator manually repairs the database. The corrupted metadata also replicates to backup cluster members, amplifying the outage.
Technical details
The vulnerability exists in the storage engine integration layer's validation of user-supplied WiredTiger configString parameters in createCollection and createIndexes operations. The validator only blocked NUL bytes, the literal substring "type=lsm", and encryption options, allowing a quoted variant like type="file" to bypass checks, override the server's bare type=file setting, and be persisted as a malformed string token in durable metadata. When diagnostic operations (collStats, validate) subsequently read this metadata, WiredTigerUtil::fetchTypeAndSourceURI triggers an invariant assertion failure that aborts mongod. Since the corrupted metadata is durable and replicated across cluster members, the denial of service persists across restarts and requires manual operator intervention to remediate. The fix rejects all user-supplied type values in configString except a redundant bare type=file.
Affected products
- MongoDB Server before 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-07-28: patched: Fix released in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0