CVE-2026-82062: MongoDB Server Auth Bypass Vulnerability

CVE-2026-82062 Overview

CVE-2026-82062 is an authorization bypass vulnerability in MongoDB Server. An authenticated user with elevated internal privileges can bypass a disabled feature gate in the applyOps command by supplying an internal replication mode value that was never intended to be client-selectable. The bypass enables container operations that are disabled by default in production, permitting direct storage-engine writes to arbitrary internal storage tables. The authorization check validates only the operation's namespace, not the actual storage target, so the attacker can write to unrelated internal metadata or to other collections' data. This flaw is classified under [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated actors with elevated internal privileges can corrupt or overwrite arbitrary internal MongoDB storage, undermining data integrity across unrelated collections and metadata.

Affected Products

MongoDB Server (specific version ranges not enumerated in the NVD record)
Deployments exposing the applyOps command to accounts with elevated internal privileges
Production configurations relying on the default-disabled container operations feature gate

Discovery Timeline

2026-09-08 - CVE-2026-82062 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82062

Vulnerability Analysis

The vulnerability resides in the handling of the applyOps command in MongoDB Server. applyOps is an internal replication primitive used to apply oplog-style operations to a database. Access to specific execution modes is controlled by a feature gate that disables container operations by default in production deployments.

An authenticated user holding elevated internal privileges can select an internal replication mode value that the client interface was never intended to expose. Supplying this value routes execution around the disabled feature gate. Once the gate is bypassed, the command dispatches container operations that perform direct storage-engine writes.

The secondary defect compounds the bypass. The authorization logic validates only the namespace declared in the operation, not the storage target actually written by the storage engine. Attackers can therefore declare a namespace they legitimately control while directing writes into unrelated collections or internal metadata tables. See the MongoDB Jira Issue SERVER-131138 for tracking details.

Root Cause

Two linked design flaws produce the vulnerability. First, an internal replication mode enumerator is accepted from client-supplied input without restricting it to modes intended for external use. Second, the authorization pipeline treats the request namespace as the authoritative target, rather than validating the actual storage handle that the container operation will write to.

Attack Vector

Exploitation requires network access to the MongoDB Server and authenticated credentials with elevated internal privileges. The attacker issues an applyOps command constructed with the internal replication mode value and container operation payload. No user interaction is required. Because the authorization check passes on the declared namespace, standard role-based access controls do not detect the misuse.

No public proof-of-concept is currently referenced in the NVD entry, and CISA KEV does not list this CVE.

Detection Methods for CVE-2026-82062

Indicators of Compromise

Unexpected applyOps command entries in MongoDB audit logs originating from application service accounts rather than replication infrastructure
Writes to internal metadata namespaces such as admin.system.* or config.* from non-administrative sessions
Divergence between the namespace declared in an applyOps payload and the collections whose contents subsequently change
Integrity failures or checksum anomalies on internal storage tables reported by dbHash or backup verification

Detection Strategies

Enable MongoDB auditing and alert on any client-issued applyOps operations, especially those containing non-standard mode fields
Correlate authenticated user activity against expected roles, flagging accounts that suddenly invoke replication-oriented commands
Baseline routine applyOps traffic from replication members by source IP and connection ID, and alert on off-baseline sources

Monitoring Recommendations

Forward MongoDB audit and diagnostic logs to a centralized analytics platform for retention and correlation
Monitor privileged role assignments (__system, root, cluster administration roles) and alert on additions or use
Track schema and metadata changes in admin, config, and local databases as high-signal integrity indicators

How to Mitigate CVE-2026-82062

Immediate Actions Required

Inventory all accounts holding elevated internal or cluster-administration privileges and revoke any that are not strictly required
Restrict network exposure of MongoDB Server so that only application tiers and replication members can reach the wire protocol
Review audit logs for prior applyOps invocations from non-replication sources and investigate any anomalies
Apply the MongoDB security update as soon as fixed builds are available for the deployed version series

Patch Information

MongoDB tracks the fix under SERVER-131138. Consult that ticket and the corresponding MongoDB release notes for the fixed version numbers applicable to your deployment channel, then upgrade all replica set members and sharded cluster components.

Workarounds

Enforce least privilege by removing the __system role and other elevated internal privileges from human and application accounts
Require x.509 or Kerberos authentication for cluster members and disable password-based access for internal roles where feasible
Constrain MongoDB listener binding to trusted management and replication networks using bindIp and firewall rules
Enable auditing with a filter that captures all uses of applyOps for forensic review

bash

# Configuration example: enable auditing of applyOps and restrict network exposure
# mongod.conf
net:
  bindIp: 127.0.0.1,10.10.0.11
  port: 27017
security:
  authorization: enabled
  clusterAuthMode: x509
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ "atype": "authCheck", "param.command": "applyOps" }'