What happened
An identified security vulnerability in MongoDB Server allows an unauthenticated network user to cause a denial of service condition on specific replica set members. The issue arises from an assertion in the server's read concern processing logic, which is reachable without authentication. This assertion's assumptions about internal server state do not hold for certain configurations, leading to the termination of the server process when the assertion is triggered. The vulnerability has been assigned CVE-2026-82064 and is rated as high severity with a CVSS score of 7.5. This vulnerability can be exploited remotely over the network via an exposed MongoDB service. No prior access or user interaction is required to trigger the issue. Successful exploitation involves directly attacking the exposed service, which may cause the server process to terminate, potentially affecting service availability. A fix addressing this vulnerability is available and should be applied to affected deployments to mitigate the risk. The fix is included in MongoDB Server versions 8.3.9 and later, 8.0.30 and later, and 7.0.41 and later. It is recommended that organisations running vulnerable versions upgrade as soon as possible. Mitigation measures such as network segmentation and access controls on MongoDB services can reduce exposure to attacks, but do not replace the need for patching.
Who is affected
Organisations running affected deployments of MongoDB Server versions 8.3.0 through before 8.3.9, 8.0.0 through before 8.0.30, and 7.0.0 through before 7.0.41 are impacted by this vulnerability. Specific configurations that include certain types of replica set members are vulnerable. These affected setups could be targeted by unauthenticated actors over network protocols, potentially resulting in server interruptions and service disruption.
Recommended actions
- Apply the available security fix by upgrading MongoDB Server to the version released after the affected versions. This update addresses the assertion flaw that can be exploited remotely.
- Restrict network exposure of MongoDB services by implementing proper segmentation and access controls. Limit access to trusted networks and authenticated clients where possible.
- Review firewall rules and network configurations to prevent unauthenticated external access to database services.
