CVE-2026-82058: MongoDB JSON Schema Validation DOS Vulnerability

CVE-2026-82058 Overview

CVE-2026-82058 is a denial-of-service vulnerability in MongoDB's mongod server process. An authenticated user holding readWrite privileges can crash the server by submitting a BSON document containing an array with a malformed numeric field name that fails a $jsonSchema items type constraint. The flaw resides in the JSON Schema validation error generation code, which performs an unsafe numeric conversion on user-controlled input without exception handling. The uncaught exception terminates the mongod process, disrupting database availability. The issue is tracked upstream as MongoDB Jira Issue SERVER-130926 and is categorized under [CWE-248] Uncaught Exception.

Critical Impact
An authenticated attacker with readWrite privileges can remotely terminate the MongoDB server process, causing service disruption for all connected clients and applications.

Affected Products

MongoDB Server (mongod)
Deployments exposing $jsonSchema validation with readWrite role access
Refer to MongoDB Jira Issue SERVER-130926 for fixed version details

Discovery Timeline

2026-09-08 - CVE-2026-82058 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82058

Vulnerability Analysis

The vulnerability arises in MongoDB's JSON Schema validation error reporting path. When a client submits a BSON document containing an array whose element field names are not valid, in-range numeric indices, the wire protocol layer does not reject the document. Instead, the malformed structure reaches the schema validator.

Once a $jsonSchema items type constraint fails, the error generation routine attempts to convert the array element's field name to an integer index. The conversion routine can throw when the value is out of range or non-numeric. Because the calling code lacks an exception handler, the uncaught exception propagates and terminates the server process.

The result is a reliable crash primitive available to any authenticated user with write privileges to a collection that has JSON Schema validation configured. The impact is limited to availability, but a single request can disrupt the entire node.

Root Cause

The root cause is missing exception handling around a numeric conversion on attacker-controlled BSON field names, combined with insufficient input validation at the wire protocol boundary. BSON array field names must be numeric string indices, but the server does not enforce this invariant before invoking the validator's error path.

Attack Vector

Exploitation requires network access to the MongoDB instance and valid credentials with readWrite privileges on a collection using $jsonSchema validation. The attacker crafts a BSON document with an array where element field names are non-numeric or out-of-range strings, then triggers a schema type mismatch. No user interaction is required. Technical details are available in MongoDB Jira Issue SERVER-130926.

Detection Methods for CVE-2026-82058

Indicators of Compromise

Unexpected mongod process terminations followed by automatic restart by process supervisors such as systemd
Server logs showing uncaught exceptions during document validation against $jsonSchema rules
Client-side connection resets or NetworkError responses correlated with insert or update operations
Repeated failed writes from a single authenticated principal preceding a crash event

Detection Strategies

Monitor mongod fatal assertion messages and abnormal exit codes in server logs
Alert on mongod process restarts that occur outside planned maintenance windows
Baseline the rate of schema validation failures per authenticated user and flag anomalous spikes
Correlate database availability drops with recent write requests targeting collections that have JSON Schema validators

Monitoring Recommendations

Ingest MongoDB audit and diagnostic logs into a centralized analytics platform for correlation
Track serverStatus uptime metrics and alert on unexpected resets
Enable MongoDB auditing for authenticate, insert, and update events to attribute crash-inducing requests
Review privileged role assignments and identify accounts holding readWrite on validated collections

How to Mitigate CVE-2026-82058

Immediate Actions Required

Upgrade mongod to the fixed release identified in MongoDB Jira Issue SERVER-130926 as soon as it is available for your branch
Audit readWrite role assignments and revoke unnecessary write privileges on collections with $jsonSchema validators
Restrict network access to MongoDB instances to trusted application tiers only
Ensure process supervision is configured so mongod restarts automatically after unexpected termination

Patch Information

MongoDB tracks the fix under SERVER-130926. Consult the MongoDB Jira Issue SERVER-130926 page for the specific server versions containing the corrected exception handling and BSON array field-name validation.

Workarounds

Temporarily remove or relax $jsonSchema validators that use items type constraints until the patch is applied
Enforce application-layer BSON document validation to reject arrays with non-numeric or out-of-range field names before they reach the database
Limit the number of accounts holding readWrite on collections that rely on schema validation
Deploy replica sets with automatic failover so a single node crash does not result in extended downtime

bash

# Example: revoke readWrite from a non-essential user until patched
mongosh --eval 'db.getSiblingDB("admin").revokeRolesFromUser("appUser", [{ role: "readWrite", db: "targetDb" }])'