CVE-2026-8063

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server. This issue affects MongoDB Server 8.2 versions prior to 8.2.7.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/SERVER-121851	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un usuario autenticado puede provocar la caída de mongod al ejecutar $rankFusion o $scoreFusion con una pipeline vacía en una vista. Al resolver una vista, el servidor inspecciona la pipeline de agregación para determinar si comienza con una etapa de Atlas Search. Para $rankFusion y $scoreFusion, esta inspección lee el primer elemento en el array de pipeline de entrada de cada etapa sin verificar primero que el array no está vacío. Suministrar una pipeline vacía provoca una desreferenciación de puntero nulo y la caída del servidor. Este problema afecta a las versiones de MongoDB Server 8.2 anteriores a la 8.2.7.

Information

Published : 2026-05-07 06:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-8063

Mitre link : CVE-2026-8063

CVE.ORG link : CVE-2026-8063

JSON object : View

Products Affected

mongodb

mongodb

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-8063", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8063", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T12:58:27.631861Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB Inc.", "product": "MongoDB Server", "versions": [{"status": "affected", "version": "8.2.0", "lessThan": "8.2.7", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T06:16:05.723", "references": [{"url": "https://jira.mongodb.org/browse/SERVER-121851", "tags": ["Issue Tracking", "Patch"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.\n\nWhen resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage\u2019s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server.\n\nThis issue affects MongoDB Server 8.2 versions\u00a0prior to 8.2.7."}, {"lang": "es", "value": "Un usuario autenticado puede provocar la ca\u00edda de mongod al ejecutar $rankFusion o $scoreFusion con una pipeline vac\u00eda en una vista.\n\nAl resolver una vista, el servidor inspecciona la pipeline de agregaci\u00f3n para determinar si comienza con una etapa de Atlas Search. Para $rankFusion y $scoreFusion, esta inspecci\u00f3n lee el primer elemento en el array de pipeline de entrada de cada etapa sin verificar primero que el array no est\u00e1 vac\u00edo. Suministrar una pipeline vac\u00eda provoca una desreferenciaci\u00f3n de puntero nulo y la ca\u00edda del servidor.\n\nEste problema afecta a las versiones de MongoDB Server 8.2 anteriores a la 8.2.7."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "CF1B1FE1-C793-450F-9C44-DDBBAE764723", "versionEndExcluding": "8.2.7", "versionStartIncluding": "8.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}