CVE-2026-82065

published 2026-09-08

CVE-2026-82065: A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a…

Priority P3 36 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
mongodb	mongodb	>= 7.0.0 < 7.0.41	7.0.41
mongodb	mongodb	>= 8.0.0 < 8.0.30	8.0.30
mongodb	mongodb	>= 8.3.0 < 8.3.9	8.3.9
mongodb	mongodb_server	>= 7.0.0 < 7.0.41	7.0.41
mongodb	mongodb_server	>= 8.0.0 < 8.0.30	8.0.30
mongodb	mongodb_server	>= 8.3.0 < 8.3.9	8.3.9

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvd v4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-617