# CVE-2026-82060: Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

> CVE-2026-82060: Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups. CVSS 5.4 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-82060
Last updated: 2026-09-16T20:36:19Z

- Published: 2026-09-08 16:12 UTC · Updated: 2026-09-16 20:36 UTC · Assigner: mongodb
- CVSS: 5.4 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- EPSS: 0.34%, 27th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-943

## Description

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-82060)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-82060)
- [https://jira.mongodb.org/browse/SERVER-131202](https://jira.mongodb.org/browse/SERVER-131202)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-82060 · Markdown: https://rewindex.com/cve/CVE-2026-82060.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-82060 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:53.124Z