Post-auth null pointer dereference when aggregating against a view with empty search pipeline
Published May 7, 2026
7.1
HIGHCVSS 4.0
EPSS 0.39%
Description
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.
When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server.
This issue affects MongoDB Server 8.2 versions prior to 8.2.7.
Affected products
-
- Version 8.2.0StatusaffectedConstraints<8.2.7
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| MongoDB Inc. | MongoDB Server | unaffected |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28326 Advisory
- https://jira.mongodb.org/browse/SERVER-121851 issue-trackingIssue TrackingPatch
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28326 | Advisory | |
| https://jira.mongodb.org/browse/SERVER-121851 | issue-trackingIssue TrackingPatch |
Change history (0)
No recorded changes yet.