CVE-2026-9750: MongoDB Server DoS Vulnerability

CVE-2026-9750 Overview

CVE-2026-9750 is a high-severity denial of service vulnerability affecting MongoDB Server. An authenticated user can crash the server or force it to return incorrect query results by crafting documents that interfere with internal metadata processing during query execution. The flaw stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths. This issue is tracked under CWE-617: Reachable Assertion.

Critical Impact

Any authenticated database user can trigger a server crash, disrupting availability for all connected applications and tenants sharing the MongoDB instance.

Affected Products

• MongoDB Server (refer to MongoDB Jira Issue SERVER-123633 for affected version ranges)

Discovery Timeline

• 2026-06-09 - CVE-2026-9750 published to the National Vulnerability Database
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-9750

Vulnerability Analysis

The vulnerability resides in MongoDB Server query execution paths where user-supplied document fields are processed alongside internal metadata. The server fails to maintain a strict boundary between these two domains. When an authenticated user inserts documents containing fields that collide with or mimic internal metadata structures, the query engine reaches inconsistent state during execution.

This inconsistency triggers reachable assertions, causing the mongod process to terminate. In other code paths, the same confusion allows the engine to proceed but return incorrect results from queries. Both outcomes undermine the integrity and availability of the database service. The vulnerability is exploitable over the network and requires only low-privileged authenticated access.

Root Cause

The root cause is insufficient separation between user-controlled document fields and internal metadata during query processing [CWE-617]. The execution engine treats certain user-supplied field names or values as if they were trusted internal markers. Without explicit namespacing or validation, crafted documents reach assertion checks that were intended only to catch internal logic errors.

Attack Vector

An attacker requires valid authenticated credentials with permissions to insert or update documents in at least one collection. The attacker then writes documents containing field names or values that overlap with the server's internal metadata schema. Subsequent queries that touch these documents trigger the assertion path, crashing the server or producing corrupted output. No user interaction beyond the authenticated session is required, and the attack is launched over the standard MongoDB wire protocol.

No public proof-of-concept code is available. Technical specifics are tracked in the vendor ticket at MongoDB Jira Issue SERVER-123633.

Detection Methods for CVE-2026-9750

Indicators of Compromise

• Unexpected mongod process terminations or repeated restarts logged by the service supervisor.
• Server log entries containing assertion failures or fatal errors during query execution against specific collections.
• Application-level errors reporting inconsistent or malformed query results from previously stable collections.

Detection Strategies

• Audit MongoDB logs for Fatal assertion and invariant failure entries correlated with query operations from authenticated users.
• Review system.profile and slow query logs for repeated queries against documents containing unusual field names that mirror internal metadata keys.
• Correlate authentication events with subsequent server crashes to identify accounts triggering the assertion path.

Monitoring Recommendations

• Enable MongoDB audit logging for insert, update, and find operations across production clusters.
• Forward mongod logs to a centralized SIEM and alert on assertion patterns and abnormal restart frequency.
• Track query result anomalies through application telemetry to detect cases where the server returns incorrect data without crashing.

How to Mitigate CVE-2026-9750

Immediate Actions Required

• Apply the MongoDB security update referenced in MongoDB Jira Issue SERVER-123633 as soon as it is available for your deployment channel.
• Review and tighten role-based access control to limit which accounts can write documents to production collections.
• Rotate credentials for any database user accounts that are shared across applications or have broader write privileges than required.

Patch Information

MongoDB tracks the fix under internal ticket SERVER-123633. Consult the MongoDB Jira Issue SERVER-123633 for fixed version numbers across the MongoDB Server release branches and apply the corresponding upgrade for your deployment.

Workarounds

• Restrict write permissions so only trusted service accounts can insert or update documents in sensitive collections.
• Enforce schema validation rules on collections to reject documents containing field names that resemble internal metadata identifiers.
• Monitor and rate-limit query traffic from low-privileged accounts until the patched MongoDB Server version is deployed.