MongoDB Server CVE-2026-104004

Exploitation requires an authenticated account with write access that can create or modify a collection validator (e.g., via create/collMod with a validator document) containing the mishandled expression; the crash is then triggered when a document is inserted into that collection and evaluated against the validator. Limiting factors: the attacker must possess write and validator-definition privileges (not available to unauthenticated or read-only users), and impact is confined to availability (process crash) with no data disclosure or modification. This is most exploitable in shared or multi-tenant MongoDB deployments where write/schema-validation privileges are broadly granted.

This is a moderate-severity availability issue, not a widespread emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) and CWE-476 (NULL pointer dereference) are internally consistent with the description: a network-reachable but authenticated (PR:L) attacker with write access can crash the server process (VA:H), with no confidentiality or integrity impact (VC:N/VI:N). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the authentication and write-privilege requirement - this is a privilege-gated denial-of-service, meaning an attacker must already hold a legitimate write-capable account (or compromise one) to abuse it, which makes it far more relevant as an insider/abuse-of-trust and resilience concern than as a mass-exploitation threat. There is no signal conflict in the data; the main gap is the absence of exploitation-probability (EPSS) and POC signals, which prevents upgrading or downgrading the raw CVSS-based priority. Treat as a standard patch-cycle item, prioritized higher for multi-tenant or shared MongoDB deployments where write access is broadly delegated.

An authenticated user holding write access on a database defines or modifies a collection validator containing a specially crafted expression that the validation feature mishandles. When a document is subsequently inserted into that collection, the server dereferences a null pointer and the mongod process crashes, denying service to all clients of that instance. No public exploit code is identified at time of analysis.