EUVD-2026-98821
GHSA-56w2-wpqh-pq52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege write account
-
DeliveryCraft bulk write targeting system namespace
-
ExploitRouter skips namespace authorization check
-
ExecutionUnauthorized write to internal namespace
-
ImpactCluster disruption or state tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a sharded MongoDB cluster accessed through the mongos write-routing component, and an attacker who is already authenticated with write privileges on at least one regular (non-system) collection. The attacker must submit a bulk write operation whose target namespace is an internal system namespace; the router then omits the per-namespace authorization check. Limiting factors: exploitation is impossible on non-sharded (standalone/replica-set-only) deployments that do not use the router path, requires valid credentials with some write privilege (PR:L - not anonymous), and the concrete impact varies by which system namespace is targeted. Fixed in 9.0.4 and 8.3.13. |
| Impact | This is a moderate-priority, authenticated privilege-escalation-style flaw rather than a critical remote threat. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) confirms it is network-reachable and low-complexity but requires an already-authenticated user holding write privileges on a regular collection (PR:L) - it is NOT a pre-auth remote compromise. The vendor scored only availability impact (VA:H, with VC:N/VI:N), implying the realistic worst case is disruption of the sharded cluster via writes to internal system namespaces rather than data theft; however, the description ('impact depends on the system namespace targeted') leaves the integrity ceiling vague, so the vendor's VI:N may understate risk for certain metadata namespaces - verify with MongoDB. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation currently requires an insider or a compromised low-privilege application credential. Net: a legitimate patch-worthy issue for multi-tenant sharded deployments, but not an emergency compared to pre-auth critical CVEs. |
| Exploit ScenarioDerived | An authenticated application user (or a compromised low-privilege service account) with write access to one ordinary collection on a sharded cluster crafts a bulk write operation whose target is an internal system namespace. The mongos router fails to re-check authorization for that target namespace and accepts the write, letting the attacker tamper with or disrupt internal cluster state they should not be able to touch. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
MongoDB Server sharded clusters running versions 9.0 before 9.0.4 or 8.3.0 before 8.3.13 allow an authenticated user with write privileges on a regular collection to bypass authorization checks for internal system namespaces by submitting a bulk write operation through the mongos router. This incorrect authorization (CWE-863) can result in unauthorized writes to system namespaces, with an impact ranging from low integrity to high availability depending on the namespace targeted. No public exploit identified at time of analysis; vendor patches are available in MongoDB Server 9.0.4 and 8.3.13.
Earlier versions of this analysis (1)
Authorization bypass in MongoDB Server's sharded cluster router (mongos) allows an authenticated user who already holds write privileges on a regular collection to submit a bulk write targeting an internal system namespace, which the router may incorrectly accept despite the user lacking authorization for that namespace. The practical impact depends on which system namespace is reached, so it ranges from limited integrity violations to potentially broader configuration changes, but the attacker cannot be anonymous and must have a pre-existing write role (PR:L). This is a medium-severity flaw (vendor CVSS 4.0 base 5.3; independent CVSS 3.1 5.3) and no public exploit or active exploitation is identified at time of analysis, so it should be treated as a moderate, not urgent, priority.
RemediationAI
Upgrade to MongoDB Server 9.0.4 or 8.3.13 as applicable; these versions contain the vendor patch. No workaround is documented, but as a compensating control, restrict write privileges on collections to trusted users and monitor for bulk write operations targeting internal system namespaces, understanding this does not fully mitigate the flaw. For non-sharded deployments, no action is required because they are not affected. Refer to the MongoDB Jira issue SERVER-131411 for patch details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the write routing component of MongoDB's sharded cluster router, mongos. In a sharded cluster, mongos routes client write operations to the appropriate shards; when a bulk write operation targets an internal system namespace (e.g., admin, config, or other internal collections), the router omits the per-namespace authorization check that would normally deny access to users lacking write privileges on that namespace. This is an instance of CWE-863 (Incorrect Authorization), where the authorization mechanism fails to verify the user's permissions for the specific target namespace. Affected product per CPE is mongodb:mongodb_server (all versions), with specific affected ranges MongoDB Server 9.0 < 9.0.4 and 8.3.0 < 8.3.13. Exploitation requires a sharded cluster deployment using mongos; standalone or replica-set-only deployments are not affected. The attacker must be authenticated with write access to at least one regular collection (PR:L) and able to submit bulk write operations. The concrete impact depends on the targeted system namespace, assessed as low integrity and high availability impact.
Know when MongoDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable (AV:N), low complexity (AC:L), but needs an authenticated write-capable user (PR:L); unauthorized system-namespace writes yield integrity and availability impact, no confidentiality disclosure.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in the write routing component of the MongoDB Server sharded cluster router can cause bulk write operations to skip authorization checks for the target namespace. An authenticated user with write privileges on a regular collection who submits a bulk write that targets an internal system namespace may have the operation accepted by the router even though they are not authorized to write to that namespace. The resulting impact depends on the system namespace targeted.
Articles & Coverage 2
Executive ViewAI
Organizations running MongoDB Server sharded clusters on versions 9.0 prior to 9.0.4 or 8.3.0 prior to 8.3.13 face a high-severity authorization flaw that can let a user with write access to a regular collection perform unauthorized writes to internal system namespaces. Depending on the namespace targeted, this could degrade data integrity or disrupt availability of the cluster, affecting business services and data trust. Vendor patches are available, and no public exploit was identified at the time of analysis, so leadership should prioritize remediation as a manageable but urgent risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Exploit-DB