CVE-2026-82062

Name of the Vulnerable Software and Affected Versions MongoDB Server (affected versions not specified)

Description An authenticated user with elevated internal privileges can bypass a disabled feature gate in the applyOps command by providing an internal replication mode value not intended for client selection. This allows the execution of container operations that are typically disabled in production, enabling direct storage-engine writes to arbitrary internal storage tables. Because the authorization check only validates the operation's namespace and not the actual storage target, it is possible to write to unrelated internal metadata or data from other collections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.