CVE-2026-96299: MongoDB mongos Denial of Service Vulnerability

CVE-2026-96299 Overview

CVE-2026-96299 is a denial of service vulnerability in MongoDB mongos, the sharded cluster router. An authenticated user with readWrite privileges can crash the router process by submitting a specially crafted aggregation pipeline. The flaw abuses an internal aggregation stage that lacks proper authorization checks, forcing a subsequent stage to execute on the router under conditions it was not designed to handle. The result is an unhandled fatal error that terminates mongos and disrupts all clients routed through the affected instance. The weakness is tracked under CWE-617: Reachable Assertion.

Critical Impact
Any authenticated user with readWrite privileges can crash the mongos process, causing immediate denial of service for all clients routed through the affected router.

Affected Products

MongoDB mongos (sharded cluster router)
Specific affected version ranges are not enumerated in the NVD record; refer to the vendor advisory for impacted builds
Deployments exposing mongos to users holding readWrite roles

Discovery Timeline

2026-10-13 - CVE-2026-96299 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-96299

Vulnerability Analysis

MongoDB aggregation pipelines allow clients to chain data transformation stages. Some stages are reserved for internal use by the server during distributed query execution. The vulnerable code path exposes one of these internal stages to clients without enforcing the authorization checks that gate its intended use. An authenticated user who crafts a pipeline that includes this stage can force a later pipeline stage to run on mongos rather than on a shard. The router is not designed to execute that downstream stage in isolation, which produces an unhandled fatal error and aborts the process. Because mongos is the entry point for client traffic into the sharded cluster, every client session routed through the crashed instance loses connectivity. In clusters that run a single router or route clients through a shared pool, the impact extends across the application tier until the process restarts.

Root Cause

The root cause is a missing authorization check on an internal-only aggregation stage, combined with a reachable assertion in the router. The stage is callable from an external pipeline, which permits a user to steer execution into a state the code treats as impossible. When the assertion fires, mongos terminates rather than returning an error to the client.

Attack Vector

The attack is network-reachable and requires authenticated access with readWrite privileges. No user interaction and no elevated privileges beyond standard data-plane access are required. The attacker submits an aggregation query containing the restricted internal stage, which forces the router to execute an incompatible subsequent stage and abort. Technical details are tracked in the vendor issue MongoDB SERVER-130431.

Detection Methods for CVE-2026-96299

Indicators of Compromise

Repeated mongos process crashes or restarts without a corresponding infrastructure event
Fatal assertion messages in mongos logs referencing aggregation pipeline execution on the router
Client-side connection resets correlating with aggregation requests from a specific authenticated user

Detection Strategies

Audit MongoDB command logs for aggregation pipelines that reference internal-only stages submitted by non-system users
Alert on mongos process exits with non-zero status codes and correlate them with recent client command activity
Baseline normal aggregation stage usage per application identity and flag deviations that include unexpected stage names

Monitoring Recommendations

Forward mongos logs and MongoDB audit logs to a centralized analytics platform for correlation across router instances
Monitor cluster-wide router availability and track crash frequency as a service-level indicator
Track authentication events for accounts holding readWrite to identify unusual query patterns preceding crashes

How to Mitigate CVE-2026-96299

Immediate Actions Required

Review the MongoDB SERVER-130431 issue and apply the fixed mongos build when published for your release train
Restrict readWrite role assignments to applications and users that require data modification
Place mongos behind application-layer controls that limit which clients can submit arbitrary aggregation pipelines

Patch Information

MongoDB tracks the fix in Jira issue SERVER-130431. Upgrade mongos to a version containing the authorization check for the affected internal aggregation stage. Consult the vendor release notes for the specific patched build that corresponds to your deployed major version before upgrading production clusters.

Workarounds

Run multiple mongos instances behind a load balancer so that a single crash does not take down the data tier
Enable process supervision (for example, systemd with automatic restart) to minimize downtime from mongos aborts
Revoke readWrite from accounts that only require read access and audit existing role grants for least-privilege alignment

bash

# Configuration example
# Verify mongos version in use
mongosh --quiet --eval 'db.version()'

# Enumerate users with readWrite on a database
mongosh admin --quiet --eval '
  db.getSiblingDB("admin").system.users.find(
    { "roles.role": "readWrite" },
    { user: 1, db: 1, roles: 1, _id: 0 }
  ).toArray()
'

# Revoke readWrite from an account that should be read-only
mongosh admin --quiet --eval '
  db.getSiblingDB("admin").revokeRolesFromUser(
    "reporting_app",
    [ { role: "readWrite", db: "analytics" } ]
  )
'