BIT-mongodb-2026-82060

    Dashboard / Vulnerabilities / BIT-mongodb-2026-82060

    BIT-mongodb-2026-82060

    Published: 17 Sept 2026Last Modified: 17 Sept 2026

    Summary: Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

    Details: In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.

    References: https://jira.mongodb.org/browse/SERVER-131202, https://nvd.nist.gov/vuln/detail/CVE-2026-82060

    Affected packages

    Package

    Name: mongodb

    Purl: pkg:bitnami/mongodb

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 7.0.0
    Fixed -7.0.41

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-mongodb-2026-82060 | CVE-DB