CVE-2026-82071
Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
CVE-2026-82071 is a high vulnerability (CVSS 7.2) in Mongodb, published September 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in mongodb 8.3.9.
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
- Record
CVE-2026-82071- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-72915
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
- Record
EUVD-2026-72915- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3566-g77x-4r27
Insufficient validation of storage engine configuration options in MongoDB Server allows an...
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
- Record
GHSA-3566-g77x-4r27- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
- Record
CVE-2026-82071- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
- Record
CVE-2026-82071- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-82071
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
- Record
UBUNTU-CVE-2026-82071- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVBIT-mongodb-2026-82071 No score
Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
- Record
BIT-mongodb-2026-82071- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mongodbBitnami |
8.3.0 up to 8.3.9 | 8.3.9 |
mongodbUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:2.4.6-0ubuntu51:2.4.6-0ubuntu61:2.4.8-1ubuntu11:2.4.8-21:2.4.9-11:2.4.9-1ubuntu11:2.4.9-1ubuntu21:2.4.9-1ubuntu2+esm2 |
None known |
mongodbUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:2.6.10-0ubuntu11:2.6.10-0ubuntu1+esm2 |
None known |
mongodbUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:3.4.7-11:3.4.7-1ubuntu11:3.4.7-1ubuntu21:3.4.7-1ubuntu41:3.4.14-3ubuntu1 Show 7 moreShow less1:3.4.14-3ubuntu21:3.6.3-0ubuntu11:3.6.3-0ubuntu1.11:3.6.3-0ubuntu1.31:3.6.3-0ubuntu1.41:3.6.3-0ubuntu1.4+esm11:3.6.3-0ubuntu1.4+esm2 |
None known |
mongodbUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu51:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.31:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |