CVE-2026-82075

CVE-2026-82075 is an uncontrolled resource consumption flaw (CWE-770) in the request-handling path of mongos, the router process of MongoDB sharded clusters. An unauthenticated client with network access to a router port can supply connection-monitoring parameters that drive the server to consume CPU resources without any rate limiting. The attacker gains the ability to degrade or fully deny service to legitimate clients, while data confidentiality and integrity remain unaffected. Only deployments running MongoDB sharded clusters whose router process is reachable by untrusted clients are affected; the source data specifies no particular version ranges. There is currently no public proof-of-concept, the issue is not in CISA KEV, and the 0.3% EPSS score indicates exploitation is considered unlikely in the next 30 days.

What to do: Identify any sharded-cluster environments in your estate and check the MongoDB security advisory for the fixed mongos release, then prioritize upgrading. Until patched, restrict network access to mongos ports to trusted clients only (firewall rules or network ACLs), since the attack requires no authentication and server-side rate limiting is absent. Monitor CPU utilization on router hosts for anomalous spikes that would indicate attempted resource-exhaustion attacks.