Description

An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T19:17:23.717Z",
  "pubdate": "2026-08-11T19:17:23.717Z",
  "executiveSummary": "An availability vulnerability has been identified in MongoDB Server affecting the handling of specific query predicates executed against time-series collections configured with a metaField.\nThe vulnerability allows an authenticated user who possesses write access to trigger an unexpected termination of the MongoDB server process, successfully inducing a denial of service condition.\nThe affected product is MongoDB Server, specifically impacting its query processing engine and time-series data storage architecture.\nThe primary risk implication is service disruption, as successful exploitation crashes the database instance, impacting database availability for applications relying on the targeted MongoDB deployment.\nAttacker capabilities are constrained by prerequisite requirements, specifically necessitating authentication and write-level privileges within the database environment.\nExploitation requires the attacker to construct and execute a specially crafted query predicate targeting a time-series collection utilizing a metaField, which induces a fatal error during server-side evaluation and leads to process termination.",
  "technicalDetails": "The vulnerability resides within the query processing and execution component of MongoDB Server, specifically in the logic responsible for evaluating query predicates against time-series collections configured with a metaField.\nThe root cause stems from insufficient input validation and error handling when the database engine parses and executes these specific query structures, leading to an unhandled exception or fatal assertion failure within the server codebase.\nThe attack vector requires the adversary to interact with the database interface using authenticated sessions. Specifically, the attacker must hold write access privileges to successfully submit the malicious query predicate or trigger the vulnerable code path.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker establishes a connection to the MongoDB Server instance using valid credentials associated with write permissions. Second, the attacker formulates a malicious query or update operation containing targeted query predicates designed to interact with the metaField of a time-series collection. Third, the attacker transmits the payload to the server. Fourth, upon receiving the request, the database query engine attempts to evaluate the malformed or destabilizing predicate against the time-series metaField data structure. Fifth, the internal logic encounters an invalid state or unhandled exception during this evaluation, triggering a server-side assertion failure. Finally, the MongoDB server process terminates abruptly, dropping all active connections and causing a denial of service for all dependent clients.\nNetwork exposure depends on the database deployment configuration, typically requiring network accessibility to the MongoDB port (default 27017).\nPost-exploitation impact is strictly limited to availability disruption; privilege escalation, arbitrary code execution, and data exfiltration are not indicated by the mechanics of this vulnerability."
}