Security context

Highlights

Auth Bypass: 146 prior fixes. Scrutinize any change in this area.

src/mongo/crypto/fle_crypto.cpp: most-fixed (6 issues). Treat as high-risk during review.

228 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Multiple critical and high-severity bypasses allowed external clients to set internal-only fields (rawData, crudProcessed, runtimeConstants.userRoles, exchange, $_translatedForViewlessTimeseries), granting elevated privileges or unauthorized operations. These fixes enforce internal-client checks but must be consistently applied across all command and aggregation entry points.

Auth Bypass: Authorization bypasses occurred when internal-client status was trusted based on client claims, and when the authorization contract was cleared or not properly tracked, allowing required checks to be skipped. Fixes added explicit privilege requirements (ActionType::internal) and contract depth tracking, but similar gaps could exist in other command paths.

Tenant Isolation Bypass: Multiple fixes enforce explicit ValidatedTenancyScope and SerializationContext to prevent cross-tenant access. Gaps existed where inner OpMsg requests or direct client calls reused operation contexts without resetting tenant scope, and where namespace/database names were serialized without tenant IDs.