This vulnerability (CVE-2026-9750) in MongoDB Server arises from a reachable assertion failure (CWE-617) caused by insufficient separation between user-controlled document fields and internal metadata during query execution. An authenticated user can craft documents that interfere with internal metadata processing, leading to server crashes or incorrect query results. The issue affects multiple recent versions of MongoDB Server (7.0.0, 8.0.0, 8.2.0, 8.3.0). The CVSS 4.0 base score is 7.1, indicating high severity. No official fix or patch has been published yet, and the vendor has not provided remediation details. The vulnerability requires authentication and does not involve user interaction or complex attack vectors. No known exploits have been reported.

An authenticated user can exploit this vulnerability to cause denial of service by crashing the MongoDB server or to compromise data integrity by causing incorrect query results. This can disrupt database availability and reliability, potentially impacting applications relying on MongoDB for data storage and retrieval.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users should monitor MongoDB's official advisories for updates. Until a patch is available, restrict authenticated user privileges to trusted users only and consider additional application-level validation to prevent malicious document creation that could trigger this issue.