Which versions of MongoDB Server are affected by CVE-2026-9747?

MongoDB Server is vulnerable to denial-of-service attacks by authenticated users, allowing attackers to crash database instances and disrupt service availability.. A patch is available.

How to fix or mitigate CVE-2026-9747?

Within 24 hours: Identify all MongoDB Server instances accessible to untrusted authenticated users and document which databases are business-critical. Within 7 days: Restrict network access to MongoDB instances to trusted hosts only, review and minimize authenticated user accounts, and enable comprehensive logging for aggregation pipeline queries. Within 30 days: Establish a plan to deploy a patched MongoDB version once available from the vendor; in the interim, evaluate any vendor-provided workarounds or feature restrictions.

MongoDB Server CVE-2026-9747

Q: What is the CVSS score of CVE-2026-9747?

CVE-2026-9747 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35863 HIGH

Reachable Assertion (CWE-617)

2026-06-09 mongodb

GHSA-43fh-5xpm-3q9m

Denial Of Service MongoDB Mongodb Server

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Updated

Jun 09, 2026 - 23:34 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 09, 2026 - 23:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 09, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Jun 09, 2026 - 23:22 NVD

MEDIUM HIGH

CVSS changed

Jun 09, 2026 - 23:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 09, 2026 - 22:50 vuln.today

DescriptionCVE.org

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

AnalysisAI

Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting aggregation pipelines that combine the internal fromRouter:true flag with runtimeConstants.userRoles. No public exploit identified at time of analysis, but the bug is tracked in MongoDB's public JIRA (SERVER-123918), which makes the trigger conditions discoverable. Impact is limited to availability (VA:H) with no data exposure or integrity compromise.

Technical ContextAI

MongoDB Server is the document-database engine that executes the aggregation framework - a pipeline-based query language. The fromRouter:true field is an internal marker normally set by mongos routers when forwarding aggregations to shards, while runtimeConstants.userRoles is an internal context variable that injects the authenticated user's roles into the pipeline. CWE-617 (Reachable Assertion) indicates the server triggers a defensive assertion when these two internal-state inputs are presented together by a client, causing the mongod process to abort rather than handle the unexpected combination safely. The CPE indicates all versions of mongodb:mongodb_server are listed as affected pending advisory clarification.

RemediationAI

Upstream fix is tracked in MongoDB JIRA SERVER-123918 at https://jira.mongodb.org/browse/SERVER-123918; released patched version not independently confirmed from the supplied references, so consult the linked ticket and the MongoDB security advisories page for the exact build numbers per release train and upgrade affected mongod and mongos instances accordingly. As a compensating control until patched, audit and tighten role-based access so that application accounts only hold roles strictly required (avoid granting broad cluster-wide aggregation privileges to user-facing services), and restrict network reachability of mongod to trusted application tiers via firewall, VPC, or bindIp configuration - accepting that this only mitigates exposure from untrusted networks, not from compromised application credentials. Monitoring mongod for unexpected restarts and enabling crash-loop alerts will help detect attempted exploitation; there is no documented configuration toggle that disables fromRouter or runtimeConstants handling without breaking sharded query execution, so workarounds beyond access restriction are limited.