CVE-2026-82062: Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
An authenticated user must already have elevated internal privileges. The issue affects MongoDB Server deployments where such a user can invoke applyOps with a client-supplied internal replication mode value.
Are default production configurations affected?
The vulnerable container operations are disabled by default in production configurations. However, the issue allows an elevated internal user to bypass that disabled feature gate through applyOps.
What access does an attacker need?
The attacker needs network access and authenticated elevated internal privileges; no user interaction is required. Exploitation relies on supplying an internal replication mode value that was not intended to be client-selectable.
What could an attacker do after exploiting the issue?
They can execute otherwise-disabled container operations and directly write to arbitrary internal storage tables. Because authorization validates the operation namespace rather than the actual storage target, writes may reach unrelated internal metadata or other collections' data.