CVE-2026-9750: Metadata name collision on $-prefixed fields causes post-auth server crash
Published Jun 9, 2026
·Updated
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.
Affected Software
1 affected component
MongoDB MongoDB Server
Event History
Jun 9, 2026
CVE Published
via MITRE·10:17 PM
Data Sourced
via MITRE·10:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-9750?
CVE-2026-9750 has a medium severity rating of 6.5.
2
How do I fix CVE-2026-9750?
To fix CVE-2026-9750, ensure you are using the latest version of MongoDB Server that addresses this vulnerability.
3
What systems are affected by CVE-2026-9750?
CVE-2026-9750 affects MongoDB Server specifically.
4
What type of vulnerability is CVE-2026-9750?
CVE-2026-9750 is a metadata name collision vulnerability that can lead to server crashes.
5
What impact does CVE-2026-9750 have on MongoDB?
CVE-2026-9750 allows an authenticated user to crash the MongoDB server or receive incorrect query results.