What is CVE-2026-82068?

CVE-2026-82068 is a medium-severity vulnerability in MongoDB Server, classified under Reachable Assertion. CVSS score: 6.5/10. Published 2026-09-08.

How severe is CVE-2026-82068?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in MongoDB Server

CVE-2026-82068

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Mongodb Server

Weakness classification (CWE)

CWE-617 — Reachable Assertion

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-82068?: CVE-2026-82068 is a medium-severity vulnerability in MongoDB Server, classified under Reachable Assertion. CVSS score: 6.5/10. Published 2026-09-08.
How severe is CVE-2026-82068?: Medium severity. CVSS v3 base score is 6.5 out of 10.