CVE-2026-82065: Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated and have privileges to create collections. No user interaction is required.
How does the denial of service persist?
The malicious storage configuration values are saved in durable metadata. Later diagnostic operations that read that metadata can trigger a fatal assertion failure, and the condition remains after server restarts.
Can the issue spread beyond the initially targeted server?
Yes. The corrupted metadata is replicated to other cluster members, so the persistent denial of service can affect additional members.
What is required to recover if the issue is exploited?
Manual operator intervention is required to restore service.