CVE-2026-82074: MongoDB Server Auth Bypass Vulnerability

CVE-2026-82074 Overview

CVE-2026-82074 is an incorrect authorization vulnerability [CWE-863] in the MongoDB Server aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that desynchronizes the server's authorization check from the operation actually executed. The result is unauthorized read access to collection data within the target database.

The flaw affects confidentiality only, but the attack requires no user interaction and works over the network with low privileges. MongoDB tracks the issue as SERVER-132275.

Critical Impact
An authenticated low-privilege database user can bypass access controls and read collection data they are not authorized to view.

Affected Products

MongoDB Server (aggregation framework component)
Specific fixed versions are tracked in MongoDB Jira issue SERVER-132275
Refer to the MongoDB Jira Issue SERVER-132275 for the authoritative version list

Discovery Timeline

2026-09-08 - CVE-2026-82074 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82074

Vulnerability Analysis

The vulnerability lives in the interaction between MongoDB's authorization subsystem and its aggregation pipeline execution path. When the server parses a specially crafted aggregation request, the authorization layer evaluates one operation while the execution engine performs a different one. This mismatch is a classic incorrect authorization pattern captured by [CWE-863].

MongoDB aggregation pipelines chain stages such as $match, $lookup, $unionWith, and $project to transform and combine documents. Several of these stages can reference other collections or reshape access boundaries. When the authorization check inspects a normalized or rewritten form of the pipeline that differs from what the executor ultimately runs, permission checks apply to the wrong target.

The result is a read-only confidentiality breach. The attacker cannot modify data or affect availability through this flaw, but they can retrieve documents from collections outside their granted role scope within the same database.

Root Cause

The root cause is a divergence between the pipeline representation used for authorization and the pipeline representation used for execution. The authorization subsystem trusts that a validated request maps one-to-one with executed operations. Crafted input breaks that invariant, letting a permitted operation act as a proxy for an unpermitted one.

Attack Vector

Exploitation requires network access to the MongoDB Server and valid credentials for any account with minimal read privileges on at least one collection. The attacker submits an aggregation request whose structure causes the parser and authorizer to evaluate a benign operation while the execution engine reads from a restricted collection. No user interaction and no elevated privileges are required.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics of the crafted pipeline are tracked in MongoDB Jira Issue SERVER-132275.

Detection Methods for CVE-2026-82074

Indicators of Compromise

Aggregation commands from low-privilege accounts that reference collections outside their normal working set
Unusual use of cross-collection stages such as $lookup, $unionWith, $graphLookup, or $merge by service or application accounts that historically issue only simple find queries
Spikes in aggregate command volume from a single authenticated principal against multiple databases or collections

Detection Strategies

Enable MongoDB audit logging with auditAuthorizationSuccess: true to capture authorized command details, then baseline per-user aggregation patterns
Correlate aggregate operations in system.profile or the audit log with the caller's assigned roles to flag reads that exceed granted collection scope
Alert on aggregation pipelines whose stage list references collection names the calling role is not explicitly granted find on

Monitoring Recommendations

Ship MongoDB audit and slow-query logs to a centralized analytics platform for retention and cross-account correlation
Track authentication events, role assignments, and privilege changes to identify accounts that could stage this attack
Monitor egress volumes from database hosts to catch bulk exfiltration that would follow successful unauthorized reads

How to Mitigate CVE-2026-82074

Immediate Actions Required

Inventory all MongoDB Server deployments and identify versions that fall within the range documented in SERVER-132275
Apply the vendor-supplied patched release as soon as it is available for your MongoDB Server track
Review and tighten role assignments so application and service accounts hold only the minimum find and aggregate privileges required
Rotate credentials for any account observed issuing anomalous aggregation traffic during triage

Patch Information

MongoDB tracks the fix under MongoDB Jira Issue SERVER-132275. Consult that issue and MongoDB's official security advisories for the exact fixed versions across supported release branches, then upgrade affected clusters following standard MongoDB rolling upgrade procedures.

Workarounds

Restrict database access at the network layer so only trusted application hosts can reach mongod listeners
Enforce least-privilege role-based access control and remove broad roles such as readAnyDatabase from application accounts
Enable audit logging with authorization success events and actively review aggregation activity from low-privilege principals until patching is complete

bash

# Enable MongoDB audit logging to capture authorized aggregation activity
# /etc/mongod.conf
security:
  authorization: enabled
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
setParameter:
  auditAuthorizationSuccess: true