Is CVE-2026-120805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120805 being exploited in the wild.

How severe is CVE-2026-120805?

Medium severity, with a CVSS score of 4.3, published 10 November 2026.

Which products and versions are affected?

MongoDB Server 7.0 before 7.0.48, 8.0 before 8.0.37, 8.2, 8.3 before 8.3.16, 9.0 before 9.0.7.

How is CVE-2026-120805 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-120805?

Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120805: MongoDB Server Queryable Encryption metadata authorization bypass

CVE-2026-120805 · Severity: medium · CVSS 4.3 · Published 2026-11-10

MongoDB Server's Queryable Encryption feature allows an authenticated database user to corrupt encrypted index metadata belonging to other collections in the same database. An attacker with insert privileges on any collection can craft specially-crafted encryption parameters to redirect internal writes to another collection's encryption state tables, bypassing authorization checks. This could corrupt the encrypted index state and break encryption functionality for other users' data.

Technologies: MongoDB Server. Vendors: MongoDB.

Quick answers

Is CVE-2026-120805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120805 being exploited in the wild.
How severe is CVE-2026-120805?: Medium severity, with a CVSS score of 4.3, published 10 November 2026.
Which products and versions are affected?: MongoDB Server 7.0 before 7.0.48, 8.0 before 8.0.37, 8.2, 8.3 before 8.3.16, 9.0 before 9.0.7.
Is there a fix for CVE-2026-120805?: Yes: fixed in MongoDB Server 7.0.48, 8.0.37, 8.3.16, 9.0.7. Until then: Restrict insert privileges in the database to trusted users only; disable Queryable Encryption if metadata integrity is critical and the application cannot be updated immediately. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120805 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-120805?: Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MongoDB Server 7.0.48, 8.0.37, 8.3.16, 9.0.7

Restrict insert privileges in the database to trusted users only; disable Queryable Encryption if metadata integrity is critical and the application cannot be updated immediately.

Technical details

The vulnerability is an authorization bypass in the Queryable Encryption (FLE2) metadata write path. An authenticated user supplies client-controlled state collection names (escCollection, ecocCollection) in encryptionInformation without server-side validation that these names match the target collection. Authorization checks occur only on the user-facing EDC (encrypted data collection) namespace; internal writes to state collections execute with _system privileges via SEPTransactionClient, allowing writes to any collection's metadata. The fix validates that state collection names cryptographically derive from the EDC collection name before any insert processing.

Affected products

MongoDB Server 7.0 before 7.0.48, 8.0 before 8.0.37, 8.2, 8.3 before 8.3.16, 9.0 before 9.0.7

Timeline

2026-11-10: advisory: CVE-2026-120805 published

References

https://jira.mongodb.org/browse/SERVER-130498

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.