CVE-2026-82071 Overview
CVE-2026-82071 is an out-of-bounds write vulnerability in MongoDB Server caused by insufficient validation of storage engine configuration options. An authenticated user with write privileges can supply crafted parameters during collection creation that override internal storage metadata. The result is an out-of-bounds memory write in the server process, producing a denial of service through a server crash. The vendor notes potential for further impact including arbitrary code execution. The weakness is tracked as CWE-787.
Critical Impact
An authenticated attacker with write privileges can crash the MongoDB Server process and potentially achieve arbitrary code execution against the database host.
Affected Products
- MongoDB Server (see MongoDB Jira Ticket SERVER-131860 for affected version ranges)
Discovery Timeline
- 2026-09-08 - CVE-2026-82071 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-82071
Vulnerability Analysis
MongoDB Server accepts storage engine configuration parameters when a client creates a new collection. These options control how the underlying storage engine allocates and manages on-disk structures for that collection. The server fails to fully validate these caller-supplied parameters before they reach internal storage metadata handling.
An authenticated attacker with write privileges can craft parameters that override internal storage metadata during the collection creation path. The corrupted metadata drives a subsequent memory operation past the intended bounds, triggering an out-of-bounds write. Attackers can use this to crash the mongod process on demand. The vendor states further impact including arbitrary code execution is possible, meaning integrity of the server process cannot be assumed once the write occurs.
Root Cause
The root cause is missing or insufficient input validation on storage engine configuration options passed through the collection creation API. Trusted internal metadata is derived from these untrusted inputs without adequate bounds or type enforcement, allowing a write outside the intended buffer as classified under CWE-787.
Attack Vector
Exploitation requires network access to the MongoDB Server and an authenticated account holding write privileges on a database where the attacker can create collections. No user interaction is required. The attacker issues a collection creation command carrying malicious storage engine options, and the server processes the request in-band.
No public proof-of-concept or in-the-wild exploitation has been reported. Refer to MongoDB Jira Ticket SERVER-131860 for vendor-authored technical details.
Detection Methods for CVE-2026-82071
Indicators of Compromise
- Unexpected mongod process crashes or restarts correlated with recent create or createCollection commands.
- MongoDB server logs containing storage engine option parsing errors, WiredTiger assertion failures, or fatal signal handlers followed by core dumps.
- Collection creation requests containing unusual or undocumented keys inside the storageEngine configuration object.
Detection Strategies
- Enable MongoDB audit logging and alert on createCollection operations that include storageEngine parameters, especially from non-administrative accounts.
- Monitor for repeated authentication followed by collection creation attempts from a single client, which may indicate exploitation attempts.
- Correlate database server crash events with the last authenticated command received to identify the responsible session and user.
Monitoring Recommendations
- Forward MongoDB audit and diagnostic logs to a centralized analytics platform for retention and correlation with process crash telemetry.
- Track privilege assignments and flag any account that gains createCollection rights outside a change-managed workflow.
- Baseline normal storageEngine option usage in your environment so anomalous configuration payloads generate alerts.
How to Mitigate CVE-2026-82071
Immediate Actions Required
- Upgrade MongoDB Server to a version that addresses SERVER-131860 as soon as the fixed release is available.
- Audit user roles and revoke createCollection or broader write privileges from accounts that do not require them.
- Restrict network reachability of mongod instances to trusted application tiers and administrative networks only.
Patch Information
Refer to the vendor advisory in MongoDB Jira Ticket SERVER-131860 for the affected version ranges and the specific fixed builds. Apply upgrades in test environments first and validate replication and backup routines before rolling forward to production clusters.
Workarounds
- Enforce least-privilege role assignments so application accounts cannot create collections; use dedicated administrative accounts for schema changes.
- Require authenticated, TLS-protected connections and disable direct client access from untrusted networks.
- Front MongoDB with a proxy or application layer that strips unexpected storageEngine fields from collection creation requests until patching is complete.
# Example: revoke collection creation privileges from an application user
mongosh --eval 'db.getSiblingDB("admin").revokeRolesFromUser("app_user", [{ role: "readWrite", db: "appdb" }])'
mongosh --eval 'db.getSiblingDB("admin").grantRolesToUser("app_user", [{ role: "read", db: "appdb" }])'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
