MongoDB: External clients can crash mongod via aggregate 'exchange' field

Vulnerability Overview Vulnerability Title: Forbid aggregate "exchange" field from non-internal clients Vulnerability Type: Bug Priority: Major - P3 Fix Status: Fixed Fixed Versions: 9.0.0-rc0, ... (4) Impact Scope Affected Versions: None Component: None Tags: None Operating System: ALL Backup Requests: v6.3, v8.2, v9.0, v7.0 Link BF Score: 200 CAR Domain: None Remediation Description: - The Exchange field is expected to be used during communication between mongos and mongod instances. - Certain code paths "trust" its content as if it originated from a verified source, implying the content should be immutable. This allows external clients to crash mongod by providing unexpected exchange state. - Invariants are being investigated and modified separately, but all exchanges should not constitute part of the attack surface. Related Links Related Tickets: - SERVER-120603: Use internal client-writeConcern in exchan... - SERVER-1206979: Temporarily exclude test in multiversion set... - SERVER-120659: Complete TODO listed in SERVER-124190 Activity Created: Apr 16 2026 01:03:37 PM UTC Updated: Jun 12 2026 08:44:42 PM UTC Resolved: Jun 09 2026 04:27:55 PM UTC Personnel Assignee: James Harrison Reporter: James Harrison Participants: James Harrison Votes: 0 Watchers: 1 Export Export Options: Export Additional Information Project: Core Server Issue: Forbid aggregate "exchange" field from non-internal clients Status: Closed Code Block POC Code/Exploit Code: None Summary This vulnerability concerns the security of the aggregate "exchange" field in MongoDB, where external clients can crash mongod by providing unexpected exchange state. The fix has been implemented in version 9.0.0-rc0 and subsequent versions, ensuring that all exchanges are not part of the attack surface.

Goal Reached Thanks to every supporter — we hit 100%!

MongoDB: External clients can crash mongod via aggregate 'exchange' field