CVE-2026-104004: Collection validators using collation-accepting expressions can crash MongoDB Server on insert

Published Oct 13, 2026

Updated

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

Affected Software

1 affected component

MongoDB MongoDB Server

Event History

Oct 13, 2026

CVE Published

via MITRE·03:36 PM

Data Sourced

via MITRE·03:36 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with write access is required. The issue is relevant where such a user can insert documents into a collection whose validator contains one of the affected expressions.

What is the impact of a successful exploit?

A later document insertion can cause the MongoDB Server process to stop running. The provided impact information indicates an availability impact, with no confidentiality or integrity impact listed.

Are default deployments affected?

The issue depends on a collection validator containing certain collation-accepting expressions and on a document being inserted afterward. The available information does not establish that a default configuration includes such a validator.

How can I determine whether I may be exposed?

Review collection validators for expressions that accept collation and identify collections where users with write access can insert documents. A server process stop during an insert into such a collection is consistent with the described behavior.

CVE-2026-104004: Collection validators using collation-accepting expressions can crash MongoDB Server on insert

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Are default deployments affected?

How can I determine whether I may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Are default deployments affected?

How can I determine whether I may be exposed?