$listCatalog now filters out internal namespaces, namely:

• local.* (the entire 'local' DB)
• config.* (the entire 'config' DB)
• <any-db>.system.* (any system.* collection in any DB), with the exception of <db>.system.js and <db>.system.buckets

Based on the discussion on slack ( https://mongodb.slack.com/archives/C02K3PFRQSF/p1781802432666189?thread_ts=1781643713.188119&cid=C02K3PFRQSF ), mongosync is already ignoring the now-filtered-out namespaces, but that should be confirmed.

Description of Linked Ticket

The collectionless form of $listCatalog performs an upfront "all or nothing" authorization check and then returns every catalog entry for the raw _mdb_catalog table with no per-namespace authorization filtering. This means that any authenticated user whose privileges satisfy the $listCatalog auth check, (listDatabases + listCollections + listIndexes on anyNormalResource) but does not hold privileges on config/local/system namespaces, can receive the catalog entries for those namespaces. The readAnyDatabase role is an example as its set of privileges is the exact same as the $listCatalog check.

The fix for this bug would involve applying the same auth checks that we do in DocumentSourceListCatalog::LiteParsed::requiredPrivileges in ListCatalogStage::doGetNext() (in the collectionless branch).

Edit: After discussing with CAR engineers, the suggested solution is to raise the overall privileges of $listCatalog. See this GitHub comment thread for more context

Edit [2026-06-26]: Eventually, a filter-based solution has been implemented, but using a different implementation than the original one.