CVE-2026-9746: Server crashes in case of the use of exchange
When using $changestreams and $requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent untrusted or unnecessary access to the database endpoints (network-level restrictions / firewall / VPC rules) so that only trusted systems and operators can authenticate and issue commands. The vulnerability requires the user be logged in to trigger, so reducing who can log in reduces exposure.
- Compensating control
Avoid issuing $changestreams with the $_requestReshardingResumeToken when using the exchange option until an official fix is released. Implement auditing/monitoring or a command-level proxy/WAF rule to detect and block attempts to use this combination.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9746?
The severity of CVE-2026-9746 is medium, rated at 6.5.
How do I fix CVE-2026-9746?
To fix CVE-2026-9746, ensure that the MongoDB server is updated to the latest version that addresses this vulnerability.
What causes the server crash in CVE-2026-9746?
The server crashes due to an invariant being hit when using $changestreams and $_requestReshardingResumeToken with the exchange option.
Do I need special privileges to exploit CVE-2026-9746?
No, no special privileges are needed to exploit CVE-2026-9746; the user must simply be logged in.
What is affected by CVE-2026-9746?
CVE-2026-9746 affects MongoDB Server when an exchange option is used with specific commands.