CVE-2026-82060 json
Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
published 2026-09-08 2 mo ago modified 2026-09-17 52 d ago also BIT-mongodb-2026-82060 , EUVD-2026-72947
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.
Patch / fix
- bitnami mongodb 7.0.41, 8.0.30, 8.3.9
- MongoDB MongoDB Server 7.0.41, 8.0.30, 8.3.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=7.0.0, <7.0.41 >=8.0.0, <8.0.30 >=8.3.0, <8.3.9 |
7.0.41 8.0.30 8.3.9 |
Affected products
- MongoDB MongoDB Server
Classification
- Weakness
-
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-131202
vendor-advisory, issue-tracking, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-82060
web
Sources
- CVE List CVE-2026-82060
- NVD CVE-2026-82060
- OSV BIT-mongodb-2026-82060
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.