Description

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-11T19:17:22.467Z",
  "pubdate": "2026-08-11T19:17:22.467Z",
  "executiveSummary": "A denial of service and data corruption vulnerability exists in MongoDB Server's handling of Queryable Encryption maintenance operations.\nThe vulnerability type is improper input validation leading to resource exhaustion and data corruption.\nThe affected product is MongoDB Server, specifically impacting its Queryable Encryption feature and encrypted index data.\nThe risk implications include potential server crashes, excessive internal write operations, severe resource exhaustion, and corruption of encrypted index data.\nAn attacker must be an authenticated user possessing readWrite privileges to successfully exploit the vulnerability.\nExploitation requires the submission of a specially crafted request during a Queryable Encryption maintenance operation that bypasses parameter validation against the collection's encrypted field configuration.",
  "technicalDetails": "The root cause of the vulnerability lies in MongoDB Server's insufficient validation of request parameters during a Queryable Encryption maintenance operation. Specifically, the server fails to properly validate incoming request parameters against the target collection's defined encrypted field configuration prior to processing.\nThe vulnerable component is the subsystem responsible for parsing and executing Queryable Encryption maintenance operations within MongoDB Server.\nAuthentication and privilege requirements dictate that an attacker must be authenticated and possess readWrite privileges on the database or collection to interact with the maintenance operation endpoints.\nThe attack flow begins when an authenticated user with readWrite privileges constructs and submits a specially formed request targeting the Queryable Encryption maintenance functionality.\nBecause input validation is missing or inadequate, the server accepts the malicious or malformed parameters without verifying them against the collection's encrypted field configuration.\nUpon processing the unvalidated request, the payload behavior triggers unintended execution paths, causing the database engine to generate excessive internal write operations.\nThis surge in internal writes leads directly to severe resource exhaustion on the host system and precipitates a server crash.\nFurthermore, the anomalous write operations result in the corruption of the underlying encrypted index data, impairing database integrity and data recoverability.\nThe post-exploitation impact is manifested as operational downtime due to server termination and persistent data integrity issues requiring manual intervention to restore corrupted encrypted indexes."
}