CVE-2026-9746: Server crashes in case of the use of exchange

Synopsis

A denial-of-service vulnerability affects MongoDB Server across the 7.0, 8.0, 8.2, and 8.3 release lines. An authenticated attacker can send a crafted query combining $changestreams and $_requestReshardingResumeToken with the exchange option, triggering an internal invariant violation that crashes the server process. Successful exploitation causes full service disruption for all clients connected to the affected instance. Patched-image rebuilds at versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the MongoDB Server over the network to issue the malicious query.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; no elevated or administrative role is needed to issue the triggering statement.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends the query directly without requiring any other user to take action.

• Attack complexityDetail

  Exploit is reliable and condition-free; no race condition, memory layout dependency, or special environmental configuration is required to trigger the crash.

Blast Radius

• Crashes the targeted MongoDB Server process, immediately dropping all active client connections.
• Causes full availability loss for every database and collection hosted on the affected instance until the process is restarted.
• Repeated triggering by the same or multiple authenticated accounts can prevent sustained recovery, creating a persistent denial-of-service condition.