Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96299— Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

Quick assessment

Affected
MongoDB MongoDB Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 MongoDB mongos（分片集群路由器）中发现了安全漏洞。具有读写权限的已认证用户可通过构造特殊格式的聚合管道（aggregation pipeline），导致 mongos 进程崩溃。该漏洞利用了内部聚合阶段存在的安全缺陷：尽管该阶段仅设计用于内部使用，却缺少适当的授权检查，从而允许后续阶段在路由器上以非预期条件执行。这会导致未被处理的致命错误，使 mongos 进程立即中止，进而造成通过受影响 mongos 实例路由的所有客户端服务不可用（拒绝服务）。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
MongoDB MongoDB Server 8.3.0< 8.3.13 affected
9.0< 9.0.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96299

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB MongoDB Server 8.3.0 ~ 8.3.13 -

II. Public POCs for CVE-2026-96299

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96299

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-96299 (1)

Same Patch Batch · MongoDB · 2026-10-13 · 5 CVEs total

CVE-2026-96297 6.5 MEDIUM MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggr
CVE-2026-104005 6.5 MEDIUM Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
CVE-2026-104004 6.5 MEDIUM Collection validators using collation-accepting expressions can crash MongoDB Server on in
CVE-2026-103965 5.4 MEDIUM Fixed values in MongoDB Server $bucket stage may be misread as field references

IV. Related Vulnerabilities

Same product: MongoDB Server
Same vendor: MongoDB
Same weakness: CWE-617

V. Comments for CVE-2026-96299

No comments yet

Leave a comment