---
id: CVE-2026-82060
title: >-
  In MongoDB, insufficient validation of shard key values during document
  insertion allowed authenticated users to store documents with specially
  crafted, operator-shaped objects as shard key values in sharded collections
summary: >-
  In MongoDB, insufficient validation of shard key values during document
  insertion allowed authenticated users to store documents with specially
  crafted, operator-shaped objects as shard key values in sharded collections.
  When change stre…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-943
vendor: mongodb
product: mongodb
affected:
  - 'mongodb >= 7.0.0, < 7.0.41'
  - 'mongodb >= 8.0.0, < 8.0.30'
  - 'mongodb >= 8.3.0, < 8.3.9'
patched:
  - mongodb 8.3.9
published: '2026-09-08'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:36:19.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82060'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-131202'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.00318
epssPercentile: 0.22002
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T18:10:33.005569Z'
ingestedAt: '2026-09-08T16:34:19.257Z'
---

## Overview

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.

## Affected

- `mongodb >= 7.0.0, < 7.0.41`
- `mongodb >= 8.0.0, < 8.0.30`
- `mongodb >= 8.3.0, < 8.3.9`

## Remediation

Upgrade past the affected range:

- `mongodb 8.3.9`