Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
MongoDb Reachable Assertion Vulnerability (CVE-2026-9746) - Vulnerability Database

MongoDb Reachable Assertion Vulnerability (CVE-2026-9746)

Description

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.

References

CVE-2026-9746

Related Vulnerabilities

MySQL CVE-2022-21594 Vulnerability (CVE-2022-21594) Medium
Common tags: Missing Update Known Vulnerabilities
Atlassian Jira Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2020-29453) Medium
Common tags: Missing Update Known Vulnerabilities
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-29002) Medium
Common tags: Missing Update Known Vulnerabilities
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-29003) Medium
Common tags: Missing Update Known Vulnerabilities
MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-29004) High
Common tags: Missing Update Known Vulnerabilities

Severity

Medium

Classification

CVE-2026-9746
CWE-617
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update
Known Vulnerabilities