CVE-2026-82057: MongoDB WiredTiger DOS Vulnerability

CVE-2026-82057 Overview

CVE-2026-82057 is a type confusion vulnerability in MongoDB that allows an authenticated user with readWrite privileges to crash the mongod server process. The flaw resides in the WiredTiger storage engine layer. An attacker specifies a custom WiredTiger storage configuration option with an incompatible value during collection creation. Subsequent read operations against the misconfigured collection produce corrupted memory interpretation and terminate the server. The malicious collection configuration persists across restarts, forcing operators to manually remediate affected collections. The vulnerability is classified under CWE-843: Access of Resource Using Incompatible Type.

Critical Impact
Any authenticated user with readWrite privileges can persistently crash the mongod process, requiring manual operator intervention to restore service availability.

Affected Products

MongoDB Server (mongod)
WiredTiger storage engine layer
Deployments accepting user-defined storageEngine configuration during collection creation

Discovery Timeline

2026-09-08 - CVE-2026-82057 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82057

Vulnerability Analysis

The vulnerability is a type confusion condition in the WiredTiger storage engine integration within mongod. When a collection is created, MongoDB accepts a storageEngine.wiredTiger.configString parameter that passes options down to the storage layer. The server does not validate that supplied values match the type expected by the storage engine for the target option.

The misconfigured collection metadata is durably written to the catalog. When a document read triggers the storage engine to interpret data using the mismatched type, memory is decoded incorrectly and the process crashes. Because the malformed configuration persists across restarts, restarting mongod alone does not restore availability. Operators must identify and remove the offending collection or repair its metadata before service resumes.

Root Cause

The root cause is missing type validation on user-supplied WiredTiger storage configuration values. The server trusts strings passed through configString and forwards them to the storage layer without verifying compatibility with the option schema. This produces the [CWE-843] type confusion when the value is later consumed as a different type during read operations.

Attack Vector

Exploitation requires network access to mongod and authenticated credentials holding readWrite on at least one database. The attacker issues a createCollection command containing a crafted storageEngine.wiredTiger.configString. Any subsequent read against that collection, initiated by the attacker or by a legitimate application, triggers the crash. The persistent nature of the malformed configuration allows a single write action to cause repeated denial of service until an operator intervenes.

No verified public exploit code is available. See the MongoDB Server Issue Tracker for vendor technical details.

Detection Methods for CVE-2026-82057

Indicators of Compromise

Unexpected mongod process termination correlated with recent createCollection commands containing storageEngine.wiredTiger options.
Collections whose catalog metadata contains unusual or non-standard configString values supplied by application accounts.
Repeated crashes on the same node immediately after startup when a specific collection is accessed.

Detection Strategies

Audit MongoDB command logs for create operations that include a storageEngine.wiredTiger.configString field, especially from non-administrative accounts.
Enable MongoDB audit logging and alert on collection creation events issued by users holding only readWrite.
Correlate mongod fatal assertions or SIGSEGV exit codes with the collection identifier accessed immediately before termination.

Monitoring Recommendations

Track mongod process uptime and restart frequency across replica set members.
Monitor authentication logs for credentials issuing schema-modifying commands outside normal application behavior.
Forward MongoDB audit and diagnostic logs to a centralized analytics platform for cross-node correlation.

How to Mitigate CVE-2026-82057

Immediate Actions Required

Apply the fixed MongoDB Server release referenced in the MongoDB Server Issue Tracker once available for your deployment channel.
Review existing collection metadata for unexpected storageEngine.wiredTiger.configString values and drop or repair affected collections.
Restrict readWrite grants to trusted service accounts and remove excess privileges from interactive users.

Patch Information

Refer to the MongoDB Server Issue Tracker entry SERVER-130495 for the authoritative list of fixed versions and backport branches. Apply vendor-supplied patches to all replica set members and mongos routers, then perform a rolling restart.

Workarounds

Revoke the ability for application accounts to specify custom storageEngine options during collection creation by using role-based access controls that limit createCollection to administrators.
Deploy a proxy or middleware layer that strips storageEngine.wiredTiger fields from client create commands.
Implement schema validation in application code so collections are provisioned only by trusted deployment tooling.

bash

# Configuration example: restrict createCollection to administrative roles
# Run in the mongo shell as an administrator

use admin
db.createRole({
  role: "appReadWriteNoDDL",
  privileges: [
    {
      resource: { db: "appdb", collection: "" },
      actions: [ "find", "insert", "update", "remove" ]
    }
  ],
  roles: []
})

# Grant the restricted role instead of built-in readWrite
db.grantRolesToUser("app_service", [ { role: "appReadWriteNoDDL", db: "admin" } ])
db.revokeRolesFromUser("app_service", [ { role: "readWrite", db: "appdb" } ])