CVE-2026-82071

Insufficient validation of storage engine configuration options in MongoDB Server allows crafted parameters supplied during collection creation to override internal storage metadata, triggering an out-of-bounds memory write (CWE-787) in the server process. Exploitation requires an authenticated user with write privileges on the target database, so there is no unauthenticated attack path. The primary result is a crash of the server process (denial of service), but MongoDB rates integrity and availability impacts as high (CVSS 4.0: 7.2) and notes potential for arbitrary code execution. Specific affected version ranges were not included in the source data, so defenders should consult MongoDB's advisory; any deployment that permits untrusted users to create collections is in scope. Exploitation has not been observed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS puts 30-day exploitation probability at about 0.3% (23rd percentile).

What to do: Apply the patched MongoDB Server release identified in MongoDB's security advisory for CVE-2026-82071 (exact fixed versions were not provided in the source data, so verify affected branches there before upgrading). Until patched, restrict collection-creation and write privileges to trusted accounts and audit application code that passes user-controlled storage-engine options during collection creation. Monitor for unexpected mongod crashes or restarts coinciding with collection-creation operations as a possible indicator of probing.