EUVD-2026-35860
GHSA-qwqf-36v4-65w4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.
AnalysisAI
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
MongoDB Server exposes a wire-protocol 'authenticate' command that negotiates the SASL mechanism a client wishes to use (e.g., SCRAM-SHA-256, MONGODB-X509, MONGODB-OIDC). Because authentication negotiation must be reachable before a session is authenticated, the command handler accepts input from any TCP client that can connect to the mongod/mongos listener. The root cause maps to CWE-1287 (Improper Validation of Specified Type of Input): when the OIDC SASL provider is enabled, certain values in the 'mechanism' field are not properly validated/typed before being dispatched into the OIDC code path, terminating the server process. CPE coverage is the generic cpe:2.3:a:mongodb:mongodb_server:*, so specific affected build ranges must be confirmed against the MongoDB advisory.
RemediationAI
Patch availability is not enumerated in the provided data, so this should be treated as 'Patch available per vendor advisory' - consult https://jira.mongodb.org/browse/SERVER-124183 and the corresponding MongoDB security advisory to identify the exact fixed minor versions for your release train and upgrade mongod/mongos to those builds. Until patched, the most effective compensating control is to disable OIDC authentication and revert to SCRAM or X.509 if business requirements allow, since the crash path is only reachable through the OIDC mechanism; this has the side effect of breaking SSO logins. As a network-layer mitigation, restrict the mongod/mongos listener (default 27017) to trusted application subnets or a bastion via firewall, security group, or bindIp, accepting that any authorized client could still trigger the crash. Increase monitoring/auto-restart (systemd Restart=, Kubernetes liveness probes) so a successful crash recovers quickly, recognizing this only reduces dwell time and does not prevent repeat exploitation.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today