What’s Vulnerable › Vulnerabilities
CVE-2026-82060: Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-08 · updated 2026-09-16
- Weakness: CWE-943
Description
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.
Affected products
- MongoDB: from 7.0.0 before 7.0.41; from 8.0.0 before 8.0.30; from 8.3.0 before 8.3.9 — fixed in 7.0.41, 8.0.30, 8.3.9
How to fix
Upgrade to a fixed version: MongoDB 7.0.41, 8.0.30, 8.3.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-82060 or the next vulnerability affects your stack