CVE-2026-104004: MongoDB Server DOS Vulnerability

CVE-2026-104004 Overview

MongoDB Server contains a flaw in its collection validation feature that can crash the server process. The vulnerability occurs when the validator stores certain expressions that are not properly handled during document insertion. Authenticated users with write access can trigger the condition by inserting a document into an affected collection. The issue is tracked as a null pointer dereference [CWE-476] and results in denial of service against the database process.

Critical Impact
Authenticated users with write permissions can crash the MongoDB server process by inserting a document that triggers mishandled validator expressions, causing availability loss.

Affected Products

MongoDB Server (see vendor advisory for affected versions)
Deployments exposing write access to authenticated users
Collections configured with document validators

Discovery Timeline

2026-10-13 - CVE-2026-104004 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-104004

Vulnerability Analysis

MongoDB collections support schema and expression validators that evaluate inserted or updated documents against configured rules. The server stores these validator expressions and executes them during write operations. When certain expressions are present in the stored validator, the server fails to properly handle them at insert time. The result is a null pointer dereference inside the server process. The process terminates and interrupts service for connected clients.

Because the trigger occurs during document insertion rather than validator creation, the malformed expression can persist in the collection configuration. Each subsequent insert attempt against the affected collection can repeat the crash. In replica set and sharded deployments, this behavior can cascade across nodes that process the same write.

Root Cause

The root cause is improper handling of specific expression types that are allowed into the stored validator but are not safely evaluated by the insert-path code. The absence of a required object or pointer check leads to a null dereference [CWE-476] when the validator is applied to an inbound document. Technical details are tracked in the MongoDB Jira issue SERVER-131412.

Attack Vector

Exploitation requires network access to the MongoDB instance and an authenticated account with write privileges sufficient to create or modify a collection validator and insert documents. No user interaction is required. The attacker crafts a validator expression that is accepted at configuration time but triggers the fault during a subsequent insert. The impact is limited to availability of the server process; the advisory does not indicate confidentiality or integrity impact.

No public proof-of-concept code is available. The vulnerability is described in prose in the referenced MongoDB Jira ticket.

Detection Methods for CVE-2026-104004

Indicators of Compromise

Unexpected mongod process termination or repeated restarts shortly after insert operations.
Server logs showing fatal signals, segmentation faults, or stack traces referencing validator or match expression code paths.
Recent collMod or createCollection operations that set or modified a validator document, followed by write failures.
Replica set members entering recovering or down states after processing the same oplog entry.

Detection Strategies

Audit MongoDB logs for SEVERE entries and abnormal exits correlated with specific collections and users.
Review the system.namespaces or collection options for recently added or modified validators using db.getCollectionInfos().
Correlate authenticated write activity with crash events to identify the account that introduced the validator.

Monitoring Recommendations

Alert on mongod process restarts, oplog replication lag, and secondary health transitions.
Monitor administrative commands such as collMod and create that change validator definitions, especially from non-administrative accounts.
Ingest MongoDB audit and system logs into a centralized analytics platform for correlation with authentication events.

How to Mitigate CVE-2026-104004

Immediate Actions Required

Review the MongoDB Jira issue SERVER-131412 to identify fixed server versions and upgrade affected deployments.
Restrict write and collMod privileges to accounts that require them, following least-privilege role assignment.
Inspect existing collection validators for unexpected or recently modified expressions and remove or correct them.

Patch Information

Refer to the vendor tracking item MongoDB Jira SERVER-131412 for the fixed release train and patch notes. Apply the vendor-supplied update across primary and secondary nodes in replica sets, and across all shards in sharded clusters, following MongoDB's standard rolling upgrade procedure.

Workarounds

Remove or rewrite validator expressions on collections where crashes have been observed using collMod with a safe validator document.
Temporarily set validationLevel to off on affected collections if removing the validator is not immediately feasible, after assessing data integrity implications.
Limit network exposure of the MongoDB service to trusted application tiers and require strong authentication for all clients.

bash

# Example: inspect and clear a problematic validator on a collection
mongosh "mongodb://<host>:27017/<db>" --eval '
  printjson(db.getCollectionInfos({ name: "<collection>" }));
  db.runCommand({
    collMod: "<collection>",
    validator: {},
    validationLevel: "off"
  });
'