CVE-2026-104005 [MEDIUM] – Incorrect authorization in the write routing component of the MongoDB Server sharded clust

Incorrect authorization in the write routing component of the MongoDB Server sharded cluster router can cause bulk write operations to skip authorization checks for the target namespace. An authenticated user with write privileges on a regular collection who submits a bulk write that targets an internal system namespace may have the operation accepted by the router even though they are not authorized to write to that namespace. The resulting impact depends on the system namespace targeted.