CVE-2026-18701: MongoDB Server DoS Vulnerability

CVE-2026-18701 Overview

CVE-2026-18701 affects the query subsystem of MongoDB Server. An authenticated user with read privileges can crash the server process by submitting a specially formed query filter. The flaw stems from a type confusion condition tracked as [CWE-843], resulting in denial of service for all database clients.

MongoDB tracks the underlying defect as SERVER-130111. The vulnerability requires only low-privilege authenticated access over the network and no user interaction. Successful exploitation impacts availability without affecting confidentiality or integrity of stored data.

Critical Impact
Any authenticated account with read access to a MongoDB deployment can terminate the mongod process, disrupting service to all applications relying on the database.

Affected Products

MongoDB Server (versions identified in SERVER-130111)
Deployments exposing mongod to authenticated read-role users
Clustered MongoDB replica sets and sharded environments where a crash affects primary or secondary members

Discovery Timeline

2026-08-11 - CVE-2026-18701 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18701

Vulnerability Analysis

The defect resides in MongoDB Server's query subsystem, which parses and evaluates BSON query filters submitted by clients. A malformed filter triggers a type confusion condition, causing the mongod process to terminate unexpectedly. The result is a denial of service against the database instance.

Type confusion vulnerabilities [CWE-843] occur when code accesses a resource using a type incompatible with the actual object type. In query evaluation paths, this often surfaces when operator handlers assume a specific BSON element type without validating the input. Executing the wrong code path against unexpected data produces an unrecoverable fault.

Because query filters are a fundamental interface for read operations, exploitation only requires a legitimate connection with read privileges. Attackers do not need elevated roles, administrative access, or user interaction. Repeated exploitation can prevent recovery by crashing the process on restart if the malicious query is retried automatically by client applications.

Root Cause

The root cause is improper type handling during query filter evaluation in the MongoDB Server query engine. When a crafted filter reaches an operator that dispatches based on element type, the resulting mismatch triggers a fatal condition. See MongoDB's issue SERVER-130111 for engineering details.

Attack Vector

Exploitation is remote and network-based. An authenticated user with any role granting read access, such as read or readWrite, submits the malformed filter through a standard driver or mongosh connection. The mongod worker handling the query terminates, disconnecting all active sessions on that node.

The vulnerability manifests during normal query processing. No specialized protocol, escalated privilege, or client-side interaction is required. Refer to SERVER-130111 for reproducer details published by MongoDB.

Detection Methods for CVE-2026-18701

Indicators of Compromise

Unexpected termination of the mongod process without preceding administrative action or resource pressure
Fatal assertion or type-related errors in MongoDB server logs immediately before process exit
Replica set failover events correlated with the same client connection or query pattern across nodes
Repeated crashes tied to a specific authenticated user submitting anomalous query filters

Detection Strategies

Enable MongoDB audit logging and monitor for authenticated read operations that immediately precede a process crash
Correlate application driver disconnect errors with server-side fatal exit codes to identify triggering queries
Track query shapes submitted by low-privilege accounts and alert on unusual operator combinations against production collections

Monitoring Recommendations

Alert on mongod process restart counts exceeding baseline in supervised deployments such as systemd, Kubernetes, or Ops Manager
Forward MongoDB server logs to a centralized platform and build detections for fatal assertion strings and abnormal termination signals
Baseline query volume per authenticated principal and flag accounts that generate parser errors or trigger driver reconnect storms

How to Mitigate CVE-2026-18701

Immediate Actions Required

Upgrade MongoDB Server to the patched version identified in SERVER-130111 as soon as a fix is available for your release train
Audit database roles and revoke read access from accounts that do not require it, reducing the pool of principals able to trigger the crash
Restrict network exposure of mongod to trusted application subnets using firewalls, security groups, or MongoDB's bindIp configuration

Patch Information

MongoDB tracks the fix in issue SERVER-130111. Apply the vendor-supplied patched release for your supported MongoDB Server branch. Deployments running End-of-Life versions should upgrade to a currently supported major version that includes the fix.

Workarounds

Enforce least privilege on database roles so only vetted service accounts hold read access to production data
Terminate stale or unused authentication credentials, including those held by decommissioned applications and users
Monitor and rate-limit clients that repeatedly cause mongod restarts, and quarantine offending credentials until patched

bash

# Configuration example: restrict network exposure and enforce authentication
# /etc/mongod.conf
net:
  bindIp: 127.0.0.1,10.0.0.5
  port: 27017
security:
  authorization: enabled