CVE-2026-82059
Vulnerability data via NVD (ingested)
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
More intel sources (5)
vuln:CVE-2026-82059vulnerabilities.cve_id: CVE-2026-82059CVE-2026-82059CVE-2026-82059"CVE-2026-82059" exploit -site:nvd.nist.gov