CVE-2026-82064: Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MongoDB Server replica set deployments may be exposed, but the issue affects only a specific type of replica set member. The provided information does not identify which member configuration is affected.
Does exploitation require valid MongoDB credentials or user interaction?
No. An unauthenticated network user can reach the affected read concern processing path, and no user interaction is required.
What is the impact of a successful attack?
A successful attack causes an assertion failure that terminates the MongoDB Server process, resulting in a denial of service. The supplied impact information indicates availability impact only, with no stated confidentiality or integrity impact.