CVE-2026-82076

CVE-2026-82076 is an integer overflow (CWE-190) in the query planning component of MongoDB Server that allows an authenticated user to bypass an internal resource limit. A user holding ordinary database-level read/write privileges can submit a specially crafted query that drives unbounded memory consumption during query planning, exhausting the host's memory and terminating the server process. The impact is a high-severity denial of service affecting every database served by the affected node, with no confidentiality or integrity impact per the CVSS 4.0 vector. All MongoDB Server deployments that grant read/write database access to untrusted or application-controlled accounts are affected. There is no known public proof of concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so exploitation has not yet been observed.

What to do: Upgrade MongoDB Server to the fixed release identified in MongoDB's security advisory for CVE-2026-82076, since no specific version ranges are available in this data. In the interim, audit and minimize the set of accounts granted database-level read/write privileges, apply least privilege, and avoid exposing mongod nodes to untrusted networks. With no public PoC and low EPSS, this can be handled in standard patch cycles unless untrusted users hold write access to your clusters.