CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
Using MongoDB Server by MongoDB?
Get instant alerts when new vulnerabilities affect MongoDB Server - before attackers find them.
Description
Incorrect authorization in the write routing component of the MongoDB Server sharded cluster router can cause bulk write operations to skip authorization checks for the target namespace. An authenticated user with write privileges on a regular collection who submits a bulk write that targets an internal system namespace may have the operation accepted by the router even though they are not authorized to write to that namespace. The resulting impact depends on the system namespace targeted.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (1)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.