CVE-2026-9750: Metadata name collision on $-prefixed fields causes post-auth server crash

Synopsis

A server crash vulnerability affects MongoDB Server across the 7.0, 8.0, 8.2, and 8.3 release lines. An authenticated user reachable over the network can craft documents whose dollar-sign-prefixed field names collide with internal metadata used during query execution, causing the server to crash or return incorrect results. Successful exploitation disrupts availability of the MongoDB instance without requiring elevated privileges. Patched-image rebuilds at versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MongoDB server over the network to send crafted documents.

• AuthenticationRequired

  Any valid low-privilege account is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No action from another user or administrator is needed to trigger the crash.

• Attack complexityDetail

  The exploit is reliable and requires no special environmental conditions, race conditions, or memory layout knowledge.

Blast Radius

• Crashes the MongoDB server process, taking the database instance offline and denying service to all connected applications.
• May cause query execution paths to return incorrect results before a crash, potentially corrupting application-layer logic that trusts query output.
• Recovery requires a process restart, introducing unplanned downtime for any workload backed by the affected MongoDB instance.