CVE-2026-9742
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.
- Affected products
- Mongodb Server, Mongo, Mongodb
- Mongodb
- < 8.2.10, 8.3.3
- CVSS 4.0
- 8.2 HIGH
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 0.3% (27th percentile)
- Weakness
- CWE-1287
- NVD status
- Analyzed
- Published
- 2026-06-09
CVE-2026-9742 at NVD
No indexed exploits for CVE-2026-9742 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-9742 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.