# CVE-2026-82065: Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata

> CVE-2026-82065: Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-82065
Last updated: 2026-09-16T20:37:30Z

- Published: 2026-09-08 16:12 UTC · Updated: 2026-09-16 20:37 UTC · Assigner: mongodb
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.40%, 34th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-617

## Description

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-82065)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-82065)
- [https://jira.mongodb.org/browse/SERVER-131420](https://jira.mongodb.org/browse/SERVER-131420)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-82065 · Markdown: https://rewindex.com/cve/CVE-2026-82065.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-82065 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:01.641Z