Skip to main content

MongoDB Server EUVDEUVD-2026-35860

| CVE-2026-9742 HIGH
Improper Validation of Specified Type of Input (CWE-1287)
2026-06-09 mongodb GHSA-qwqf-36v4-65w4
Denial Of Service Mongodb Server
8.2
CVSS 4.0 · Vendor: mongodb
Share

Severity by source

Vendor (mongodb) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Patch available
Jun 10, 2026 - 02:01 EUVD
Analysis Updated
Jun 09, 2026 - 23:37 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 09, 2026 - 23:37 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 09, 2026 - 23:22 vuln.today
cvss_changed
CVSS changed
Jun 09, 2026 - 23:22 NVD
7.5 (HIGH) 8.2 (HIGH)
Analysis Generated
Jun 09, 2026 - 22:46 vuln.today

DescriptionCVE.org

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

AnalysisAI

Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify MongoDB endpoint with OIDC enabled
Delivery
Open unauthenticated TCP session to 27017
Exploit
Send authenticate command with crafted mechanism value
Execution
Trigger input validation failure in OIDC path
Persist
Crash mongod/mongos process
Impact
Repeat across replica set members for cluster outage
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires (1) the target mongod/mongos to be configured with OIDC authentication enabled (authenticationMechanisms includes MONGODB-OIDC) - explicitly called out in the description and reflected in the CVSS AT:P flag - and (2) network reachability to the database port (default 27017) from the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Risk is meaningful for OIDC-enabled deployments and limited for everyone else. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with TCP reach to a MongoDB instance that has OIDC authentication enabled opens an unauthenticated connection and sends an 'authenticate' command containing a malformed 'mechanism' value, causing mongod to terminate. Repeating the single packet against every node - including arbiters and config servers - produces sustained outage of the replica set or sharded cluster. …
Remediation Patch availability is not enumerated in the provided data, so this should be treated as 'Patch available per vendor advisory' - consult https://jira.mongodb.org/browse/SERVER-124183 and the corresponding MongoDB security advisory to identify the exact fixed minor versions for your release train and upgrade mongod/mongos to those builds. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit which MongoDB instances have OIDC authentication enabled and implement firewall rules restricting network access to trusted internal networks only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mongodb Server

View all
CVE-2026-8053 HIGH
8.7 May 12

Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
CVE-2026-4148 HIGH
8.7 Mar 17

MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
CVE-2026-9740 HIGH
8.7 Jun 09

Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod

CVE-2026-8336 HIGH
7.7 May 13

Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
CVE-2026-9753 HIGH
7.2 Jun 09

Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
CVE-2026-9750 HIGH
7.1 Jun 09

MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash t
CVE-2026-9748 HIGH
7.1 Jun 09

Remote denial-of-service in MongoDB Server allows an authenticated user to crash the mongod process by submitting an agg
CVE-2026-9752 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial q
CVE-2026-9743 HIGH
7.1 Jun 09

Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the ser
CVE-2026-9749 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pi
CVE-2026-9747 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting ag
CVE-2026-9746 HIGH
7.1 Jun 09

Denial of service in MongoDB Server occurs when an authenticated user issues a $changeStreams aggregation combined with

Same weakness CWE-1287 – Improper Validation of Specified Type of Input

View all
CVE-2025-46342 HIGH POC
8.5
CVE-2025-32442 HIGH POC
7.5
CVE-2026-21932 HIGH
7.4
CVE-2026-24307 CRITICAL
9.3
CVE-2026-2004 HIGH
8.8
CVE-2026-26115 HIGH
8.8
CVE-2025-9042 HIGH
8.7
CVE-2025-9041 HIGH
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8
CVE-2013-3163 HIGH POC
8.8
CVE-2014-1776 CRITICAL POC
9.8

Share

EUVD-2026-35860 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy