CVE-2026-9742: Authenticate command with specific mechanism parameter can trigger server crash

Synopsis

A pre-authentication denial-of-service vulnerability affects MongoDB Server versions 8.2.0 through 8.2.9 and 8.3.0 through 8.3.2 when OIDC authentication is enabled. An unauthenticated remote attacker can send a crafted "mechanism" parameter value in the "authenticate" command, triggering a server crash without any prior login. Successful exploitation brings down the MongoDB process, making the database unavailable to all connected applications. Patched-image rebuilds at versions 8.2.10 and 8.3.3 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MongoDB Server's listen port over the network; any host with TCP access to the port can send the malicious authenticate command.

• AuthenticationNot required

  The authenticate command is accessible to unauthenticated clients, so no credentials or account of any kind are needed before triggering the crash.

• Victim interactionNot required

  No user or administrator action is needed; the attacker sends the crafted command directly to the server without any social-engineering step.

• Attack complexityDetail

  The CVSS vector notes an attack requirement of Partial (AT:P), meaning the vulnerable OIDC code path is only reachable when OIDC authentication is explicitly enabled in the server configuration, though no other environmental condition must be timed or manipulated.

Blast Radius

• Crashes the MongoDB Server process, taking the database offline and blocking all read and write operations until the service is manually or automatically restarted.
• Any application or service that depends on the affected MongoDB instance loses its database connection for the duration of the outage.
• Repeated unauthenticated requests can be used to sustain a crash loop, preventing operators from restoring service without first mitigating network access to the port.