Which versions of MongoDB Server are affected by EUVD-2026-35860?

MongoDB Server with OIDC authentication enabled is vulnerable to unauthenticated, remote denial-of-service attacks that crash the database process, instantly rendering data unavailable to dependent…. A patch is available.

How to fix or mitigate EUVD-2026-35860?

Within 24 hours: audit which MongoDB instances have OIDC authentication enabled and implement firewall rules restricting network access to trusted internal networks only. Within 7 days: disable OIDC authentication on all affected MongoDB servers and migrate to alternative authentication methods (SCRAM or x.509 certificates); document all changes. Within 30 days: establish automated monitoring of MongoDB security advisories and develop a tested deployment plan to apply vendor patches immediately upon release.

MongoDB Server EUVD-2026-35860

Q: What is the CVSS score of EUVD-2026-35860?

EUVD-2026-35860 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-9742 HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-06-09 mongodb

GHSA-qwqf-36v4-65w4

Denial Of Service MongoDB Mongodb Server

8.2

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Updated

Jun 09, 2026 - 23:37 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 09, 2026 - 23:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 09, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jun 09, 2026 - 23:22 NVD

7.5 (HIGH) 8.2 (HIGH)

Analysis Generated

Jun 09, 2026 - 22:46 vuln.today

DescriptionCVE.org

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

AnalysisAI

Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MongoDB Server exposes a wire-protocol 'authenticate' command that negotiates the SASL mechanism a client wishes to use (e.g., SCRAM-SHA-256, MONGODB-X509, MONGODB-OIDC). Because authentication negotiation must be reachable before a session is authenticated, the command handler accepts input from any TCP client that can connect to the mongod/mongos listener. The root cause maps to CWE-1287 (Improper Validation of Specified Type of Input): when the OIDC SASL provider is enabled, certain values in the 'mechanism' field are not properly validated/typed before being dispatched into the OIDC code path, terminating the server process. CPE coverage is the generic cpe:2.3:a:mongodb:mongodb_server:*, so specific affected build ranges must be confirmed against the MongoDB advisory.

RemediationAI

Patch availability is not enumerated in the provided data, so this should be treated as 'Patch available per vendor advisory' - consult https://jira.mongodb.org/browse/SERVER-124183 and the corresponding MongoDB security advisory to identify the exact fixed minor versions for your release train and upgrade mongod/mongos to those builds. Until patched, the most effective compensating control is to disable OIDC authentication and revert to SCRAM or X.509 if business requirements allow, since the crash path is only reachable through the OIDC mechanism; this has the side effect of breaking SSO logins. As a network-layer mitigation, restrict the mongod/mongos listener (default 27017) to trusted application subnets or a bastion via firewall, security group, or bindIp, accepting that any authorized client could still trigger the crash. Increase monitoring/auto-restart (systemd Restart=, Kubernetes liveness probes) so a successful crash recovers quickly, recognizing this only reduces dwell time and does not prevent repeat exploitation.