CVE-2026-9749: Using MaxKey() may crash the server

Synopsis

A server crash vulnerability exists in MongoDB Server affecting the internal $exchange aggregation stage when used with key-range partitioning and order-preserving delivery. The flaw is reachable over the network by any low-privilege authenticated user, and successful exploitation crashes the MongoDB server process, causing a full denial of service. Patched-image rebuilds at versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable MongoDB Server must be reachable over the network; an attacker sends a crafted aggregation pipeline request across a network connection.

• AuthenticationRequired

  A low-privilege account is sufficient; any authenticated MongoDB user who can run aggregation pipelines can trigger the vulnerable code path.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits the malicious pipeline request directly without requiring any action from another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other environmental factors.

Blast Radius

• Crashes the MongoDB server process, taking the database offline and making all hosted data inaccessible until the service is restarted.
• Any application or service that depends on the affected MongoDB instance loses database connectivity for the duration of the outage.
• No confidentiality or integrity impact is present; the attacker cannot read or modify stored data through this vulnerability.