CVE-2026-104005: CWE-617: Reachable Assertion in MongoDB MongoDB Server

The vulnerability arises from improper authorization enforcement in the MongoDB Server's sharded cluster router during bulk write operations. Specifically, an authenticated user with write privileges on a normal collection can submit bulk writes targeting internal system namespaces, which the router may accept without proper authorization checks. This could lead to unauthorized writes to sensitive internal namespaces, with the exact impact dependent on the targeted namespace. The affected versions are >=8.3.0 <8.3.13 and >=9.0 <9.0.4. There is no indication of known exploits in the wild, and no patch links were provided in the input data.

An authenticated user with write privileges on a regular collection can bypass authorization checks for bulk writes targeting internal system namespaces. This could allow unauthorized modification of internal system data, potentially affecting database integrity or security depending on the namespace targeted. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information was provided in the input data. Until a fix is available, restrict write privileges carefully and monitor for unusual bulk write operations targeting internal namespaces.