Issue Description
Date announced: May 14, 2026
Impact: In sharded clusters, a unique index with a non-simple collation (for example, case-insensitive) whose shard key equals or is a strict prefix of the index key pattern does not enforce uniqueness across shards. Different shards can independently accept documents with byte-distinct but collation-equivalent values (for example, "YES" and "yes"), silently breaking uniqueness guarantees.
This requires two or more shards, a unique index with a non-simple collation, and the shard key equals or is a strict prefix of the index key pattern.
MongoDB Versions:
5.0.0 - 5.0.32
6.0.0 - 6.0.28
7.0.0 - 7.0.31
8.0.0 - 8.0.20
8.2.0 - 8.2.6
Details
We have identified a critical issue in which unique index enforcement can silently fail on sharded collections when the index is defined with non-simple collation. When this occurs, multiple documents with logically equivalent values for the same key can be accepted across different shards, violating the uniqueness guarantee of the index without any error.
This issue affects you only if all four of the following are true:
Your deployment is a sharded cluster with two or more shards;
A sharded collection has a unique index that uses a non-simple collation (for example, locale-specific or case-insensitive, such as
{locale: "en_US", strength: 2});The shard key is equal to, or is a strict prefix of, that unique index's key pattern (for example, if your unique index with non-simple collation is on
{a: 1,b: 1}and the shard key is{a: 1}or{a: 1, b: 1}).Your workload includes inserts or updates that produce values that are distinct at the raw string level but are treated as identical by the index collation (for example, "YES" and "yes" under a case-insensitive collation), and those values are routed to different shards.
The latest patch versions of MongoDB contain fixes for this issue. Action is only needed if all of the above conditions are met.
Action Items
For MongoDB Atlas Customers: Your Atlas clusters have already been upgraded to versions containing fixes for this issue as part of our proactive response for CVE-2026-8053. Please note that the issue described in this critical advisory is unrelated to the CVE; we simply delivered these fixes together to prevent the need for an additional upgrade.
If your application meets the criteria above, we recommend that you:
Before upgrading, avoid creating new unique indexes with non-simple collations where the shard key equals or prefixes the index key, and avoid schema changes (for example, through collMod) that would introduce such combinations.
If duplicates exist, review and de-duplicate the affected documents according to your application's business logic. Scripts are provided in SERVER-85346 to assist with identifying duplicates.
Upgrade to the latest MongoDB patch version.
For more information, see SERVER-85346. If you have any questions, open a support case or start a chat with the Atlas Support team.