CVE-2026-82060: MongoDB Information Disclosure Vulnerability

CVE-2026-82060 Overview

CVE-2026-82060 is a NoSQL injection vulnerability in MongoDB caused by insufficient validation of shard key values during document insertion. Authenticated users can store documents containing operator-shaped objects as shard key values in sharded collections. When change stream events for these documents are processed with updateLookup full document mode, MongoDB embeds the crafted values into internal post-image lookup queries without proper sanitization. The server interprets these values as query operators rather than literal equality values. Consumers of the affected change streams may receive incorrect post-image documents or encounter non-resumable fatal errors that disrupt downstream data pipelines.

Critical Impact
Authenticated attackers can poison change stream post-image lookups in sharded MongoDB collections, causing incorrect data delivery or fatal, non-resumable change stream errors.

Affected Products

MongoDB Server (sharded cluster deployments)
Collections configured with sharding enabled
Change stream consumers using fullDocument: 'updateLookup'

Discovery Timeline

2026-09-08 - CVE-2026-82060 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82060

Vulnerability Analysis

The flaw is classified under [CWE-943] Improper Neutralization of Special Elements in Data Query Logic. MongoDB validates that a shard key value exists in an inserted document, but it does not verify that the value is a literal scalar or plain sub-document. An authenticated user with insert privileges on a sharded collection can supply a value shaped like a MongoDB query operator, for example an object whose keys begin with $. The server accepts and stores the document. Storage of the malformed value is not itself the impact. The problem surfaces later, when a change stream is opened against the collection using updateLookup full document mode. To resolve the post-image, MongoDB constructs an internal lookup query and embeds the stored shard key value directly into the query filter without sanitization. The embedded operator-shaped object is then interpreted as an active query operator rather than an equality predicate.

Root Cause

The root cause is a trust boundary violation between document insertion and query construction. Insert-path validation treats shard key values as opaque data, while the change stream post-image resolver treats them as trusted filter components. No neutralization step exists between the two paths to strip or reject operator-shaped input.

Attack Vector

Exploitation requires an authenticated session with permission to insert documents into a sharded collection. The attacker crafts a document whose shard key field contains an object modeled on a MongoDB query operator. Once a change stream consumer requests the post-image for that document with updateLookup, the malformed value is spliced into the internal lookup filter. Depending on the operator chosen, the consumer receives the wrong post-image, an empty result, or a fatal error that terminates the change stream and prevents resumption. Full technical details are available in the MongoDB Issue Tracker Entry.

Detection Methods for CVE-2026-82060

Indicators of Compromise

Documents in sharded collections whose shard key values are objects containing keys prefixed with $ such as $ne, $gt, or $regex.
Change stream consumers reporting non-resumable fatal errors when fullDocument: 'updateLookup' is enabled.
Unexpected mismatches between change stream post-image documents and the current state of the underlying collection.

Detection Strategies

Audit sharded collections for documents where the shard key value type is a sub-document containing operator-prefixed keys.
Review MongoDB audit logs for insert operations from low-privileged accounts targeting sharded collections with anomalous shard key shapes.
Correlate change stream error telemetry with recent insert activity to identify potential poisoning attempts.

Monitoring Recommendations

Enable MongoDB auditing for insert and update operations on sharded collections and forward logs to a centralized analytics platform.
Alert on repeated non-resumable change stream failures across services consuming the same collection.
Track authenticated database roles that hold insert privileges on sharded collections and periodically review their necessity.

How to Mitigate CVE-2026-82060

Immediate Actions Required

Apply the MongoDB security update referenced in the MongoDB Issue Tracker Entry as soon as it is available for your release train.
Scan sharded collections for existing documents with operator-shaped shard key values and quarantine or repair them.
Restrict insert privileges on sharded collections to trusted service accounts only.

Patch Information

Refer to the MongoDB Issue Tracker Entry for fixed version numbers and backport availability. Upgrade all mongod and mongos nodes in a sharded cluster to the patched release before re-enabling change streams that use updateLookup.

Workarounds

Temporarily switch affected consumers away from fullDocument: 'updateLookup' and rely on default full document mode until patching is complete.
Add application-layer validation that rejects inserts where any shard key field value is an object containing keys beginning with $.
Enforce least-privilege authorization so that only vetted service identities can write to sharded collections.

bash

# Query to identify documents with operator-shaped shard key values
# Replace <db>, <collection>, and <shardKeyField> with your values
mongosh --eval '
  db.getSiblingDB("<db>").<collection>.find({
    $where: function() {
      var v = this.<shardKeyField>;
      if (typeof v !== "object" || v === null) return false;
      return Object.keys(v).some(function(k) { return k.indexOf("$") === 0; });
    }
  })
'