CVE-2026-82065Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
Updated under an hour ago ()
Does this affect you?
It affects MongoDB Server and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-617
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mongodb
- NVD analysis
- Analyzed
- Record last updated
- Sep 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
MongoDB MongoDB Server mongodb:server (from the name) | from 8.3.0 before 8.3.9; from 8.0.0 before 8.0.30; from 7.0.0 before 7.0.41 | CNA record |
mongodb mongodb mongodb:mongodb | from 7.0.0 before 7.0.41; from 8.0.0 before 8.0.30; from 8.3.0 before 8.3.9 | NVD |
References
- https://jira.mongodb.org/browse/SERVER-131420vendor-advisory, issue-tracking
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.