CVE-2026-104005: 
MongoDB vulnerability analysis and mitigation

CVE-2026-104005 is a denial-of-service vulnerability in MongoDB's mongos sharded cluster router component, where an authenticated user with readWrite privileges can crash the mongos process by submitting a specially crafted aggregation pipeline. The vulnerability was published on October 13, 2026, and affects MongoDB Server versions 8.3.0 through 8.3.12 and 9.0.0 through 9.0.3. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is a combination of Incorrect Authorization (CWE-863) and Reachable Assertion (CWE-617): an internal aggregation stage within mongos lacks proper authorization checks despite being intended exclusively for internal use. An attacker with readWrite privileges can craft an aggregation pipeline that invokes this internal stage, which in turn forces a subsequent pipeline stage to execute on the router under conditions it was not designed to handle. This triggers an unhandled fatal assertion error, causing the mongos process to immediately abort. The issue is tracked internally by MongoDB as SERVER-131411 (GitHub Advisory).

Successful exploitation causes the targeted mongos process to immediately abort, resulting in a complete denial of service for all clients routed through that mongos instance. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. In sharded MongoDB deployments with a single or limited number of mongos routers, exploitation could disrupt database access for all dependent applications until the process is restarted (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with at least readWrite privileges, which limits the attacker pool but does not eliminate insider or compromised-credential threat scenarios.

1. Obtain credentials: Acquire valid MongoDB credentials with at least readWrite privileges on a database hosted in a sharded cluster — this could be through credential theft, insider access, or a compromised application account.
2. Identify mongos endpoint: Locate the mongos router's network address and port (default: 27017) using network scanning or application configuration review.
3. Connect to mongos: Establish an authenticated connection to the mongos instance using a MongoDB client (e.g., mongosh, PyMongo, or the official driver).
4. Craft malicious aggregation pipeline: Construct an aggregation pipeline that invokes the vulnerable internal aggregation stage (which lacks proper authorization checks) followed by a stage that forces execution on the router under unsupported conditions.
5. Submit the pipeline: Execute the crafted aggregation pipeline against a collection in the sharded cluster via the mongos router.
6. Trigger crash: The internal stage bypasses authorization, the subsequent stage executes on the router under invalid conditions, an unhandled fatal assertion fires, and the mongos process immediately aborts — denying service to all connected clients (GitHub Advisory).

• Logs: Sudden appearance of fatal assertion or unhandled error messages in the mongos log (e.g., Invariant failure, Fatal assertion, or Aborting) immediately following an aggregation command from a specific client.
• Logs: MongoDB audit logs showing an authenticated user submitting an unusual or complex aggregation pipeline containing internal stage names not typically used by applications.
• Process: Unexpected termination (crash/abort) of the mongos process, potentially visible in system logs (/var/log/syslog, journalctl) or process monitoring tools.
• Network: Repeated connection attempts from the same client IP to the mongos port shortly before each crash event, suggesting automated or repeated exploitation attempts.

MongoDB has released patched versions addressing this vulnerability: upgrade to MongoDB Server 8.3.13 or later (for the 8.3.x branch) or MongoDB Server 9.0.4 or later (for the 9.0.x branch) (GitHub Advisory). As interim mitigations, restrict readWrite privileges to only trusted and necessary users, and implement network-level access controls (e.g., firewalls, VPCs) to limit which hosts can connect to mongos instances. Monitor aggregation pipeline submissions for anomalous patterns, particularly those referencing internal stage names.