An authenticated user with readWrite privileges on a MongoDB sharded cluster can craft a specially formatted aggregation pipeline that triggers an unhandled fatal error in the mongos router. The vulnerability arises from an internal aggregation stage that bypasses proper authorization checks, causing the mongos process to abort immediately. This results in an outage for all clients routed through that instance, effectively denying service to users of the affected shard cluster.

The issue affects MongoDB Server supplied by MongoDB, Inc. No specific version range is listed in the available data; the vulnerability applies to all releases of mongos that contain the internal aggregation stage without proper authorization checks.

The CVSS score of 7.1 indicates a high severity denial of service flaw. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the vulnerability requires authenticated access with readWrite role—a common workload for application users. The vulnerability is not yet listed in the CISA KEV catalog. Attackers who can log into the cluster can trigger the DoS by sending a crafted aggregation pipeline; no special network or physical access is required beyond normal authentication.