CVE-2026-82060

Name of the Vulnerable Software and Affected Versions MongoDB (affected versions not specified)

Description Insufficient validation of shard key values during document insertion allows authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for these documents are processed using the updateLookup full document mode, the crafted values are embedded into internal post-image lookup queries without proper sanitization. This causes the values to be interpreted as query operators instead of literal equality values, which may lead to change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.