CVE-2026-104004: 
MongoDB vulnerability analysis and mitigation

CVE-2026-104004 is a Denial of Service vulnerability in MongoDB Server's collection validation feature that may not properly handle certain expressions stored in a validator, causing the server process to crash when a document is subsequently inserted. It affects MongoDB Server versions 8.0.0–8.0.33, 8.3.0–8.3.12, and 9.0.0–9.0.3. The vulnerability was disclosed on October 13, 2026, with patches published the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-476 (NULL Pointer Dereference): MongoDB Server's collection validation logic fails to properly handle certain expressions embedded in a collection validator, leading to a null pointer dereference when a document insertion triggers evaluation of the malformed expression. The attack vector is network-based, requires low privileges (authenticated write access), no user interaction, and low attack complexity. An attacker must first create or have access to a collection with a specially crafted validator expression, then insert a document to trigger the crash (GitHub Advisory). The underlying issue is tracked in MongoDB's internal issue tracker as SERVER-131412.

Successful exploitation results in a complete loss of availability for the MongoDB server process — the server stops running, causing a denial of service for all connected clients and applications. There is no impact on confidentiality or data integrity, as the vulnerability only affects availability. In environments where MongoDB is a critical backend, this could cause cascading failures in dependent services and applications (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with write privileges, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Obtain write access: Authenticate to the target MongoDB Server instance using valid credentials with write access to at least one collection (e.g., a low-privileged database user).
2. Create or modify a collection validator: Use the db.createCollection() or db.runCommand({ collMod: ... }) command to set a collection validator containing a specially crafted expression that triggers improper handling in the validation engine.
3. Insert a triggering document: Insert a document into the collection with the malicious validator. The server's validation logic evaluates the stored expression against the new document, triggering a NULL pointer dereference.
4. Server crash achieved: The MongoDB server process terminates, resulting in a denial of service for all clients connected to that instance (GitHub Advisory).

• Logs: Unexpected MongoDB server process termination entries in mongod.log; crash stack traces referencing collection validation or expression evaluation code paths; log entries showing SERVER-131412-related assertion failures.
• Process: Sudden absence of the mongod process; automatic restart events if a process supervisor (e.g., systemd, Docker) is configured.
• Database: Collections with unusual or complex validator expressions that were recently created or modified, particularly by low-privileged users; audit log entries showing createCollection or collMod commands with validator fields from unexpected users or times.

MongoDB has released patched versions addressing this vulnerability: upgrade to 9.0.4, 8.3.13, or 8.0.34 or later. As an interim workaround, restrict write access to collections with validators containing potentially complex or suspicious expressions, and review existing collection validators for unusual content. Monitoring for unexpected server shutdowns can help detect exploitation attempts (GitHub Advisory).