In MongoDB, insufficient validation of shard key values by the server allowed authenticated users to insert documents that contain query‑operator‑like objects as key values in sharded collections. When change‑stream events that include post‑image data are processed using the updateLookup mode, the server embeds the unfiltered shard key value into an internal lookup query. Because the value is interpreted as a query operator instead of a literal, the resulting query can return incorrect documents or cause a fatal error that makes the stream non‑resumable. The weakness is an injection of query operators (CWE‑943), which can lead to data integrity problems and service disruption for consumers that rely on accurate change‑stream post‑image data.

The affected product is MongoDB Server. The CVE does not list a specific vulnerable release, so any MongoDB Server deployment that uses sharding and change streams with the updateLookup mode is potentially vulnerable until a patch is applied. Administrators should check the MongoDB release notes and advisory for the version in use.

The CVSS score is 2.3, indicating a low severity baseline. EPSS is not available and the vulnerability is not in the CISA KEV catalog, so the public exploitation likelihood is considered low. However, the flaw requires authenticated database access and the ability to write to a sharded collection, so the attack surface is limited to privileged users. Nonetheless, because the effect is a non‑resumable fatal error or incorrect post‑image data, organizations that rely heavily on change streams should treat this as a potential operational risk.