CVE-2026-82065

MongoDB Server contains a flaw in its storage engine integration layer in which user-supplied storage configuration options are insufficiently validated before being persisted to durable metadata. An authenticated user holding collection-creation privileges can submit a malicious option value that is written to disk, and when diagnostic operations later read that metadata the server hits a fatal assertion failure (CWE-617, Reachable Assertion) and crashes. Because the corrupted metadata persists across restarts and is replicated to other cluster members, the outage recurs and spreads across replica sets or sharded clusters, requiring manual operator intervention to restore service. Any deployment that grants collection-creation rights to partially trusted users is at risk; the vendor advisory defines the exact affected version ranges, which are not specified in the available data. There is no public proof-of-concept and no known in-the-wild exploitation; EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Check MongoDB's security advisory for this CVE to identify whether your deployed version is affected and upgrade to the patched release it specifies. Until patched, restrict collection-creation privileges to trusted administrative roles and audit any user- or application-supplied storage engine configuration options. If a cluster hits the fatal assertion, follow vendor recovery guidance and validate metadata integrity on all members rather than repeatedly restarting, since the corruption is durable and replicated.