CVE-2026-96299 Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...