MongoDB CVE-2026-9742: Quick Look at the Pre-Auth OIDC Denial-of-Service Vulnerability

Introduction

An unauthenticated client can crash a MongoDB server with a single crafted authenticate command when OIDC authentication is enabled, which makes this a zero-interaction, zero-credential denial-of-service vulnerability. MongoDB holds nearly 46% of the NoSQL database market, and OIDC adoption is growing alongside enterprise zero-trust initiatives. For organizations that have moved their database layer to federated identity, CVE-2026-9742 is a meaningful risk.

It is also the second OIDC-related pre-authentication DoS vulnerability disclosed in MongoDB within approximately 12 months, following CVE-2025-6709 (CVSS 7.5, published June 2025). The pattern suggests systemic weaknesses in the OIDC authentication subsystem, not isolated bugs.

Technical Information

Root Cause: CWE-1287 and Overly Permissive Input Handling

CVE-2026-9742 is classified under CWE-1287 (Improper Validation of Specified Type of Input), a child of CWE-20 (Improper Input Validation) and a peer of CWE-843 (Type Confusion). The MongoDB server's authenticate command does not properly validate the type of the mechanism parameter before processing it. When a client supplies a mechanism value outside the expected set of valid types, the server neither rejects the input nor handles it gracefully, and it crashes.

The MongoDB Jira ticket SERVER-124183, titled "Limit scope of authenticate," states the cause in its internal description: "authenticate is more generic than it needs to be." That confirms the problem is in the design of the authenticate command, not a simple missing null check or boundary condition. The command accepted a broader range of mechanism parameter values than the server could safely process.

CWE-1287 has appeared in other notable vulnerabilities, including CVE-2024-37032 ("Probllama"), which affected the Ollama AI platform. In that case, failure to validate a digest-format input allowed path traversal and arbitrary file reads. The impact differs (data exposure versus denial of service), but the underlying pattern is identical. In both cases the server assumes input conforms to an expected type and never enforces that assumption.

CVSS Vector Analysis

The CVSS v4.0 vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N yields a score of 8.2 (HIGH). The v3.x score is 7.5. The metrics break down as follows:

The AT:P (Attack Requirements: Present) qualifier is what limits the scope. Only MongoDB deployments with OIDC authentication explicitly enabled are vulnerable. Deployments using SCRAM, X.509, or LDAP authentication without OIDC are not affected by this specific flaw. Any deployment that uses OIDC for federated identity with providers such as Azure AD or Google Workspace is exposed.

Attack Flow

An attacker exploits CVE-2026-9742 through the following sequence:

1. Connect to a target MongoDB server that has OIDC authentication enabled. The authenticate command is accessible to unauthenticated clients, so no credentials are needed to reach the vulnerable code path.

2. Send an authenticate command with a crafted value in the mechanism parameter. The exact values that trigger the crash have not been publicly disclosed, but the vulnerability description confirms that "specific values" in the mechanism parameter cause the crash.

3. The server processes the invalid mechanism value without proper type validation. Because the authenticate handler is "more generic than it needs to be," it tries to process the unexpected input instead of rejecting it at the validation boundary.

4. The server crashes and becomes unavailable to all connected clients and dependent applications. The CVSS AC:L rating implies low attack complexity and a deterministic crash, so the exploit can be repeated reliably to maintain a denial-of-service condition.

The attacker needs only a standard MongoDB client, or any network socket that can send MongoDB wire protocol commands. The attack happens entirely before authentication, so apart from the OIDC configuration requirement, network access to the MongoDB port is the only prerequisite.

OIDC Authentication Context

MongoDB's OIDC authentication mechanism supports workload identity federation, which lets applications authenticate to MongoDB with tokens from external identity providers. It is documented across MongoDB's driver ecosystem (Node.js, Java, .NET) and increasingly adopted in cloud-native deployments. OIDC is not enabled by default, but as more teams use it for database authentication, the pool of potentially vulnerable deployments keeps growing.

Affected Systems and Versions

The Jira ticket SERVER-124183 lists "Affects Version/s: None," which may mean the affected version range is not publicly disclosed, or that the flaw exists across a broad range of MongoDB Server versions. Based on the available fix information:

Fixed Versions:

• MongoDB Server 8.3.3 (v8.3 branch)
• MongoDB Server 8.2.10 (v8.2 branch)

Vulnerable Configuration Requirement: OIDC authentication must be enabled in the MongoDB server configuration. Deployments using only SCRAM, X.509, or LDAP authentication are not vulnerable to this specific flaw.

The fix is marked "Fully Compatible," so upgrading to the patched versions raises no backward-compatibility concerns. The fix was backported to both the v8.3 and v8.2 release branches.

MongoDB Atlas managed service customers should check their cluster versions, because Atlas may receive automatic patching on a different timeline.

Vendor Security History

MongoDB's authentication subsystem has been a recurring source of security vulnerabilities in 2025 and 2026. The table below lists the most significant recent server vulnerabilities and how each relates to CVE-2026-9742:

CVE-2025-6709 and CVE-2026-9742 appeared within approximately 12 months of each other, and both target the same OIDC authentication mechanism with the same attack pattern (pre-auth DoS). The Jira ticket's description ("authenticate is more generic than it needs to be") suggests the fix for CVE-2026-9742 addresses a broader design issue instead of a narrow parameter check. That may explain why the earlier fix for CVE-2025-6709 did not prevent this second vulnerability.

CVE-2025-14847 (MongoBleed) matters most for threat context. Bitsight security researchers confirmed it was actively exploited in the wild, and Palo Alto Unit 42 published a dedicated threat brief. MongoDB server vulnerabilities clearly attract real threat actor attention and are weaponized in practice.

MongoDB is its own CVE Numbering Authority (CNA) and controls disclosure timelines for its products. The Server Security team developed the SERVER-124183 fix over five sprints from April to June 2026, and the ticket was resolved on June 9, 2026.

References

• NVD Entry for CVE-2026-9742
• MongoDB Jira: SERVER-124183 "Limit scope of authenticate"
• CWE-1287: Improper Validation of Specified Type of Input
• MongoDB Alerts Page
• Red Hat Security Advisory RHSA-2026:9742
• MongoDB OIDC Authentication Mechanism Documentation (Node.js)
• MongoDB OIDC Authentication Mechanism Documentation (Java)
• NVD Entry for CVE-2025-14847 (MongoBleed)
• Bitsight: CVE-2025-14847 MongoDB MongoBleed
• Palo Alto Unit 42: Threat Brief on CVE-2025-14847
• SentinelOne: CVE-2026-25611 MongoDB Server DOS Vulnerability
• CISA Known Exploited Vulnerabilities Catalog
• MongoDB CVEs on OpenCVE
• MongoDB Market Share in NoSQL Databases (6sense)
• MongoDB Q1 FY2027 Financial Results