CVE-2026-82062

MongoDB Server contains an incorrect-authorization flaw (CWE-863) in the applyOps command, whose authorization check validates only the operation's namespace rather than the actual storage target. An authenticated user with elevated internal privileges can trigger it by passing an internal replication mode value that was not intended to be client-selectable, thereby bypassing a feature gate that is disabled by default in production configurations. Successful exploitation lets the user execute normally disabled container operations and write directly to arbitrary internal storage-engine tables, potentially corrupting internal metadata or other collections' data; CVSS 4.0 scores this 7.0 (High), with high integrity and low availability impact and no confidentiality impact. Any deployment of MongoDB Server in which such privileged authenticated users exist is potentially affected, although affected version ranges were not specified in the available data. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Consult MongoDB's CVE-2026-82062 security advisory to identify the affected and patched releases and upgrade accordingly, since exact version ranges are not stated here. In the meantime, restrict applyOps and internal replication-mode options to trusted administrative roles and audit logs for unexpected applyOps invocations. If privileged accounts may have been abused, verify the integrity of internal metadata and collection data, as the flaw allows writes outside the intended namespace.