Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Authenticate command with specific mechanism parameter can trigger server crash (MongoDB MongoDB Server)

CVE-2026-9742
HIGH 8.2

At a glance

Source
NVD
EPSS
EPSS 0.35 % · percentile 28 ()
State
PUBLISHED
Published
Updated
Assigner
mongodb
NVD status
Analyzed

Search on…

Description

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

Weaknesses (CWE)

  • CWE-1287 — Improper Validation of Specified Type of Input

References

Scores

VersionScoreVectorScored by
CVSS 4.0HIGH 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Nmongodb
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hmongodb
CVSS 4.0HIGH 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · cna@mongodb.com (Secondary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · cna@mongodb.com (Secondary)
CVSS 3.1MEDIUM 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
MongoDB · MongoDB Serveraffected 8.3.0 < 8.3.3 ; affected 8.2.0 < 8.2.10

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD