CVE-2026-104005

Name of the Vulnerable Software and Affected Versions MongoDB mongos (affected versions not specified)

Description An issue in the sharded cluster router allows an authenticated user with readWrite privileges to cause a denial of service by crafting a specially formed aggregation pipeline. This occurs because an internal aggregation stage lacks proper authorization checks, forcing a subsequent stage to execute on the router under unsupported conditions, leading to a fatal error and process abort. Additionally, incorrect authorization in the write routing component may allow bulk write operations to skip authorization checks for the target namespace. An authenticated user with write privileges on a regular collection could potentially target an internal system namespace, and the router might accept the operation despite the user lacking the necessary permissions for that specific namespace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.