CVE-2026-82071: Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted…

PriorityP352high8.1CVSS 3.1

AVNACLPRLUINSUCNIHAH

EPSS

0.54%

44.7th percentile

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mongodb	mongodb	>= 8.3.0 < 8.3.9	8.3.9
mongodb	mongodb_server	>= 8.3.0 < 8.3.9	8.3.9

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

nvdv4.07.2HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.