MongoDB Server CVE-2026-8063

Attack requires CVSS-specified conditions: (1) authenticated database user credentials (PR:L - low privilege level, typically read-only application user), (2) network access to the MongoDB port (default 27017), and (3) execution of an aggregation query that includes $rankFusion or $scoreFusion operator applied to a view with an intentionally empty pipeline array. The vulnerability does NOT require administrative privileges, non-default MongoDB configuration, or special MongoDB features beyond standard aggregation pipeline support and views. However, the MongoDB instance must be configured to accept remote or network connections (non-localhost binding); completely isolated localhost-only instances are not vulnerable via remote network attack. The presence of views in the database and user authorization to query views are implicit prerequisites.

This vulnerability presents a moderate denial-of-service risk with limited scope. CVSS 6.5 (AV:N/AC:L/PR:L) correctly reflects that remote unauthenticated exploitation is impossible-the attack requires valid database authentication credentials. The low attack complexity (AC:L) and network vector (AV:N) indicate the attack is straightforward once authentication is obtained. The availability impact (A:H) is real but scoped to a single MongoDB instance; no confidentiality or integrity compromise occurs. EPSS data is unavailable for this 2026-dated CVE, limiting modern exploitation probability assessment. No active exploitation signals are provided (no KEV status, no POC reference). The vulnerability is functionally a crash-only DoS, mitigated by its authentication requirement-insider threats or compromised application accounts are the realistic attack vector. For most deployments with properly restricted database access, this is low-to-moderate priority; for public or loosely-authenticated MongoDB instances, it becomes high-priority. The impact is service disruption, not data loss.

An authenticated application user or insider connects to a MongoDB instance running version 8.2.0-8.2.6 and executes an aggregation query containing $rankFusion or $scoreFusion with an empty pipeline stage against a view. The mongod process crashes immediately upon attempting to inspect the empty pipeline array, causing service unavailability for all connected clients. The attacker needs no special privileges beyond basic database read access and can reproduce the crash repeatedly.