CVE-2026-104005: MongoDB mongos Denial of Service Vulnerability

CVE-2026-104005 Overview

CVE-2026-104005 affects MongoDB mongos, the sharded cluster router. An authenticated user holding readWrite privileges can crash the mongos process by submitting a specially crafted aggregation pipeline. The pipeline leverages an internal aggregation stage that lacks proper authorization checks, forcing a subsequent stage to execute on the router under unsupported conditions. The result is an unhandled fatal error [CWE-617] that aborts mongos immediately, producing denial of service for every client routed through the affected instance.

Critical Impact

Any authenticated user with readWrite privileges can terminate a mongos router process on demand, disrupting all applications depending on that router.

Affected Products

• MongoDB mongos (sharded cluster router component)
• Deployments exposing sharded clusters to authenticated application users
• Multi-tenant MongoDB environments relying on mongos for query routing

Discovery Timeline

• 2026-10-13 - CVE-2026-104005 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-104005

Vulnerability Analysis

The vulnerability resides in MongoDB's aggregation framework as implemented by mongos. Aggregation pipelines in MongoDB consist of ordered stages that transform documents. Some stages are marked for internal use only and are expected to execute on mongod shard nodes rather than the routing layer.

The affected internal stage does not enforce authorization checks commensurate with its sensitivity. An authenticated user with ordinary readWrite privileges can include this stage in a pipeline. When combined with a subsequent stage, the planner routes execution to mongos in a path the stage was never designed to handle. The process then hits an unrecoverable assertion and aborts.

The failure mode is a reachable assertion [CWE-617], not memory corruption. Confidentiality and integrity remain intact, but availability is lost for every client bound to the terminated router. In sharded production environments with multiple application tiers, loss of a single mongos can cascade through connection pools and retry logic.

Root Cause

The root cause is a missing authorization check on an internal aggregation stage, compounded by a planner path that permits that stage to feed a downstream stage into execution on mongos. The downstream stage's preconditions are violated on the router, triggering a fatal error.

Attack Vector

Exploitation requires network access to a mongos instance and valid credentials with readWrite on at least one database. The attacker issues a single crafted aggregation command. No user interaction is required and attack complexity is low. See the MongoDB Server Issue Tracker for upstream details.

Detection Methods for CVE-2026-104005

Indicators of Compromise

• Unexpected mongos process termination entries in system logs, often preceded by a fatal assertion message.
• Aggregation commands containing unusual or undocumented pipeline stage names originating from application accounts.
• Repeated client reconnection attempts and connection pool errors against a specific mongos endpoint.

Detection Strategies

• Parse mongos logs for F ASSERT, fassert, or invariant entries correlated with aggregate commands.
• Alert on mongos restart events outside of planned maintenance windows.
• Baseline aggregation stage usage per application identity and flag deviations introducing internal-only stages.

Monitoring Recommendations

• Forward mongos audit logs and slow query logs to a centralized SIEM for correlation.
• Track process uptime and crash counts per mongos host as a service-level indicator.
• Monitor authenticated session activity and command patterns for low-privilege accounts issuing abnormal pipelines.

How to Mitigate CVE-2026-104005

Immediate Actions Required

• Apply the fixed MongoDB release referenced in SERVER-131411 as soon as it is available for your deployment channel.
• Audit database users and remove readWrite privileges from accounts that do not require them.
• Restrict network exposure of mongos endpoints to trusted application subnets only.

Patch Information

MongoDB tracks the fix under issue SERVER-131411. Consult the MongoDB Server Issue Tracker for the list of patched versions aligned with your current branch and upgrade accordingly.

Workarounds

• Enforce least-privilege role assignment so untrusted or shared application identities cannot issue arbitrary aggregation pipelines.
• Deploy multiple mongos instances behind a load balancer with health checks and automatic failover to limit outage scope.
• Use connection-layer filtering or a database proxy to inspect and block pipelines containing unexpected internal stage names until patched.

# Example: remove readWrite from a non-essential account and verify roles
mongosh --eval 'db.getSiblingDB("admin").revokeRolesFromUser("reportingUser", [{ role: "readWrite", db: "analytics" }])'
mongosh --eval 'db.getSiblingDB("admin").getUser("reportingUser", { showPrivileges: true })'