This vulnerability (CVE-2026-82068) in MongoDB Server involves a reachable assertion (CWE-617) triggered by an authenticated user with write privileges through specially crafted retryable write commands. The resulting fatal assertion crash is persistent, causing the server process to repeatedly crash upon restart. This persistent crash state can propagate to additional nodes in a sharded cluster, leading to broader service disruption. The vulnerability affects specific versions of MongoDB Server (8.3.0, 8.0.0, and 7.0.0). There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported as of the publication date.

An authenticated user with write privileges can cause a persistent crash of the MongoDB Server process, leading to denial of service. The crash state is durably persisted, so the server repeatedly crashes on restart until manual intervention occurs. This can also propagate to other nodes in a sharded cluster, potentially causing wider service outages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write privileges to trusted users only and prepare for manual recovery procedures if the crash occurs. Monitor official MongoDB channels for updates and patches addressing this issue.