CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert
Authenticated users with write access can crash the MongoDB server by inserting documents that trigger a null dereference in collection validators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104004?
CVE-2026-104004 is a high-severity vulnerability in MongoDB Server, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.
Weakness: CWE-476
Which versions are affected by CVE-2026-104004?
How do I fix CVE-2026-104004?
No fix has been published for CVE-2026-104004 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104004 being exploited?
There is no known exploitation of CVE-2026-104004 in the wild and no public exploit code.
Sources
Also known as GHSA-v57p-wcq9-v96q, UBUNTU-CVE-2026-104004.