CVE-2026-8063: Post-auth null pointer dereference when aggregating against a view with empty search pipeline
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.
When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server.
This issue affects MongoDB Server 8.2 versions prior to 8.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.2.7 - Compensating control
Avoid running $rankFusion or $scoreFusion with an empty pipeline on a view; ensure the pipeline is non-empty so the aggregation does not trigger the null pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8063?
The severity of CVE-2026-8063 is categorized as high due to the potential for a denial-of-service attack resulting from a null pointer dereference.
How do I fix CVE-2026-8063?
To fix CVE-2026-8063, upgrade MongoDB Server to version 8.2.7 or later where this vulnerability has been addressed.
Who is affected by CVE-2026-8063?
CVE-2026-8063 affects authenticated users of MongoDB Server versions prior to 8.2.7 when using aggregation against a view with an empty pipeline.
What can an attacker do with CVE-2026-8063?
An attacker can exploit CVE-2026-8063 to crash the MongoDB server by executing specific aggregation commands with an empty search pipeline.
Is there a workaround for CVE-2026-8063?
A temporary workaround for CVE-2026-8063 is to avoid using the $rankFusion or $scoreFusion commands with empty pipelines until an upgrade is possible.