CVE-2026-104004: CWE-476: NULL Pointer Dereference in MongoDB MongoDB Server
Description
CVE-2026-104004 is a high-severity vulnerability in MongoDB Server's collection validation feature. Certain expressions stored in a validator may not be properly handled, leading to a NULL pointer dereference that causes the server process to stop when a document is inserted. This issue affects authenticated users with write access. The vulnerability impacts multiple MongoDB Server versions prior to specific fixed releases.
CVSS v4.0
Score 7.1high
Affected software
MongoDB
MongoDB Server
pkg:github/mongodb/mongoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-104004 involves a NULL pointer dereference in MongoDB Server's collection validation feature. When certain expressions are stored in a validator, the server may crash upon insertion of a document. This flaw affects authenticated users with write permissions and can cause denial of service by stopping the server process. The CVSS 4.0 score is 7.1, indicating a high severity. Affected versions include MongoDB Server versions >=8.3.0 and <8.3.13, >=8.0 and <8.0.34, and >=9.0 and <9.0.4. No vendor advisory or patch links are provided in the input, so patch status is not confirmed.
Potential Impact
Exploitation of this vulnerability can cause the MongoDB Server process to stop unexpectedly, resulting in denial of service. The impact is limited to authenticated users with write access, who can trigger the server crash by inserting documents that interact with the flawed validator expressions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, restrict write access to trusted users and monitor for unusual server crashes related to document insertions involving collection validators.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-10-01T16:21:43.606Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace567b2cdf04f65683952e
Added to database: 10/13/2026, 16:04:11 UTC
Last enriched: 10/13/2026, 16:18:18 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.