Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps MongoDB/MongoDB Server (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for MongoDB/MongoDB Server.
2. 2Review the reported fix. Update MongoDB/MongoDB Server to 8.3.9 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 8, 2026

Sources and claim methodology

• Source referencejira.mongodb.org

Related CVEs

• Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of ServiceSame mongodb/mongodb server package
• Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate BypassSame mongodb/mongodb server package
• Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of ServiceSame mongodb/mongodb server package
• Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersSame mongodb/mongodb server package
• Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted MetadataSame mongodb/mongodb server package
• Heap Out-of-Bounds Read in MongoDB Server Query Planning ComponentSame mongodb/mongodb server package