CVE-2026-104004— Collection validators using collation-accepting expressions can crash MongoDB Server on insert
Quick assessment
Affected
MongoDB MongoDB Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB Server 的集合验证功能可能无法正确处理存储在验证器（validator）中的某些表达式。在某些情况下，当后续插入文档时，这可能导致服务器进程停止运行。这种行为可能对具有写入权限的已认证用户发生。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | MongoDB Server | 8.3.0< 8.3.13 |
affected |
8.0< 8.0.34 |
affected | ||
9.0< 9.0.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104004
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
Source: CVE Program / CVE List V5
Vulnerability Description
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 ~ 8.3.13 | - |
|
II. Public POCs for CVE-2026-104004
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104004
请登录查看更多情报信息。
Same Patch Batch · MongoDB · 2026-10-13 · 5 CVEs total
| CVE-2026-96297 | 6.5 MEDIUM | MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggr |
| CVE-2026-96299 | 6.5 MEDIUM | Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads t |
| CVE-2026-104005 | 6.5 MEDIUM | Incorrect authorization in MongoDB Server router for bulk writes to system namespaces |
| CVE-2026-103965 | 5.4 MEDIUM | Fixed values in MongoDB Server $bucket stage may be misread as field references |
IV. Related Vulnerabilities
Same product: MongoDB Server
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_ -
CVE-2026-89099
Race Condition in MongoDB Server Document Value Layer Leads
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_ -
CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in
Same weakness: CWE-476
V. Comments for CVE-2026-104004
No comments yet