CVE-2026-82059

Name of the Vulnerable Software and Affected Versions MongoDB Server (affected versions not specified)

Description An internal aggregation expression was incorrectly registered as accessible to any authenticated user instead of being restricted to internal cluster operations. An authenticated user with read-only privileges can trigger an assertion failure in the index key generation code path by crafting a malformed index specification within this expression. In specific build configurations, this failure leads to the termination of the mongod process, resulting in a denial of service for all connected clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.