CVE-2026-89099

A race condition (CWE-362) in the document value layer of MongoDB Server lets concurrent server threads operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger the condition through the normal client protocol by driving concurrent operations against the server. Successful exploitation can terminate the server process and corrupt process memory with user-influenced content, potentially affecting the confidentiality, integrity, and availability of the database; the flaw is rated 7.7 (High) under CVSS 4.0. Any MongoDB Server deployment is potentially affected, but the provided data does not specify which version ranges are vulnerable, so operators should consult MongoDB's advisory to confirm whether their releases are in scope. As of this writing the issue is not in CISA's KEV, no public proof-of-concept is known, and no active exploitation has been reported.

What to do: Upgrade MongoDB Server to the fixed release identified in MongoDB's advisory; because this data does not include affected or fixed version ranges, verify your deployed versions against the official advisory before patching. In the meantime, restrict read-write database credentials to trusted users and limit network exposure of MongoDB instances, since triggering the flaw requires an authenticated client session. Watch for unexpected database server crashes or restarts on affected clusters, as these could indicate exploitation attempts.