CVE-2026-9746: Server Denial of Service Vulnerability

CVE-2026-9746 Overview

CVE-2026-9746 is a denial-of-service vulnerability in MongoDB that causes the server process to crash when an authenticated client combines $changeStream aggregation stages with the $_requestReshardingResumeToken option and the exchange option. The server triggers an internal invariant check, which terminates the running mongod process. The flaw is classified under CWE-617: Reachable Assertion. Exploitation requires only a valid authenticated session with no elevated privileges, making the issue accessible to any database user who can issue aggregation pipelines.

Critical Impact
Any authenticated MongoDB user can crash the mongod server process remotely by issuing a single crafted aggregation pipeline, producing a database-wide denial of service.

Affected Products

MongoDB Server (versions tracked under SERVER-124190)
Deployments that allow authenticated users to execute aggregation pipelines containing $changeStream
Sharded clusters supporting resharding resume tokens

Discovery Timeline

2026-06-09 - CVE-2026-9746 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-9746

Vulnerability Analysis

The vulnerability resides in how MongoDB's aggregation framework validates option combinations on change stream pipelines. When a client submits an aggregation that contains a $changeStream stage together with the internal $_requestReshardingResumeToken flag and the exchange option, execution reaches a code path the developers assumed was unreachable. The server then trips an invariant() macro, which calls std::abort() and crashes the mongod process. Because the failure occurs inside the query execution engine, every active connection on the affected node is terminated alongside the crash.

The attacker requires only network access to the MongoDB endpoint and any authenticated identity. No administrative roles, cluster privileges, or write access are required to reach the vulnerable code path.

Root Cause

The root cause is a missing validation check on the combination of pipeline options. $_requestReshardingResumeToken is intended for internal use during sharded cluster resharding, and exchange is used to parallelize aggregation output. Their combination with $changeStream was not anticipated by the option-compatibility logic, so input validation does not reject the request. The query planner proceeds until an internal consistency assertion fails, and the assertion handler terminates the process rather than returning an error to the client [CWE-617].

Attack Vector

Exploitation is single-request and entirely network-based. An authenticated attacker connects through any standard MongoDB driver or the mongosh shell and issues an aggregate command containing the offending stage and options. The command does not need to return results: parsing and planning are sufficient to reach the invariant. The vulnerability does not expose data confidentiality or integrity, but successful exploitation produces a hard crash of the mongod process, requiring service restart and resume from the oplog.

No public proof-of-concept code is associated with CVE-2026-9746. Technical details are tracked in the MongoDB Issue Tracker SERVER-124190.

Detection Methods for CVE-2026-9746

Indicators of Compromise

Unexpected mongod process termination accompanied by invariant or Fatal assertion messages in the MongoDB log.
Repeated short-interval restarts of mongod correlated with client aggregate commands referencing $changeStream.
Aggregation requests in audit logs containing both $_requestReshardingResumeToken and an exchange specification from non-internal clients.

Detection Strategies

Enable MongoDB auditing and alert on aggregate commands that include the $_requestReshardingResumeToken option from user-tier accounts.
Parse mongod.log for F - severity entries and invariant strings, then correlate timestamps with client command logs.
Monitor process supervisors such as systemd for abnormal exit codes on the mongod unit and treat them as security events.

Monitoring Recommendations

Forward MongoDB audit and diagnostic logs to a centralized SIEM and build a rule for invariant crashes triggered within seconds of an aggregation command.
Track baseline change stream usage per client identity so that anomalous use of internal options is flagged automatically.
Alert on cluster availability metrics, including primary step-downs and replica set elections that follow crash patterns rather than planned maintenance.

How to Mitigate CVE-2026-9746

Immediate Actions Required

Apply the MongoDB security patch tracked in SERVER-124190 as soon as it is available for your release train.
Audit existing database users and remove unnecessary accounts that can issue arbitrary aggregation pipelines.
Restrict network exposure of mongod and mongos endpoints to trusted application hosts only.

Patch Information

MongoDB has tracked the fix under the issue SERVER-124190. Administrators should consult the corresponding MongoDB release notes for the fixed minor version on their deployed major release branch and schedule a rolling upgrade across replica set members and shards.

Workarounds

Revoke the ability to execute aggregation pipelines for accounts that do not require change stream functionality, using fine-grained role assignments.
Place a query proxy or driver-level filter in front of mongod that rejects pipelines containing the $_requestReshardingResumeToken option from external callers.
Run mongod under a supervisor that restarts the process on crash to reduce outage duration while patching is scheduled.

bash

# Example: restrict aggregation usage by assigning a minimal role
use admin
db.createRole({
  role: "readNoAggregate",
  privileges: [
    { resource: { db: "app", collection: "" }, actions: [ "find" ] }
  ],
  roles: []
})
db.grantRolesToUser("app_user", [ { role: "readNoAggregate", db: "admin" } ])