CVE-2026-104004: Collection validators using collation-accepting expressions can crash MongoDB Server on insert
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with write access is required. The issue is relevant where such a user can insert documents into a collection whose validator contains one of the affected expressions.
What is the impact of a successful exploit?
A later document insertion can cause the MongoDB Server process to stop running. The provided impact information indicates an availability impact, with no confidentiality or integrity impact listed.
Are default deployments affected?
The issue depends on a collection validator containing certain collation-accepting expressions and on a document being inserted afterward. The available information does not establish that a default configuration includes such a validator.
How can I determine whether I may be exposed?
Review collection validators for expressions that accept collation and identify collections where users with write access can insert documents. A server process stop during an insert into such a collection is consistent with the described behavior.