Is CVE-2026-120807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120807 being exploited in the wild.

How severe is CVE-2026-120807?

Medium severity, with a CVSS score of 6.6, published 10 November 2026.

Which products and versions are affected?

MongoDB Server 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.2.x, 8.3.x before 8.3.16, 9.0.x before 9.0.7.

How is CVE-2026-120807 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120807?

Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120807: MongoDB X.509 cluster authentication privilege escalation

CVE-2026-120807 · Severity: medium · CVSS 6.6 · Published 2026-11-10

MongoDB is a widely used database that stores and retrieves business data. When configured with X.509 certificate-based cluster authentication, a flaw in the internal checks that separate cluster-member certificates from regular user accounts could allow an attacker with a valid cluster certificate to gain full administrative access to the database under specific conditions. This could lead to complete data breach, data manipulation, or destruction of all stored information.

Technologies: MongoDB Server. Vendors: MongoDB.

Quick answers

Is CVE-2026-120807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120807 being exploited in the wild.
How severe is CVE-2026-120807?: Medium severity, with a CVSS score of 6.6, published 10 November 2026.
Which products and versions are affected?: MongoDB Server 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.2.x, 8.3.x before 8.3.16, 9.0.x before 9.0.7.
Is there a fix for CVE-2026-120807?: Yes: fixed in 7.0.48, 8.0.37, 8.3.16, 9.0.7. Until then: Ensure X.509 cluster authentication is only enabled when necessary, restrict cluster certificates to known trusted systems, and keep enforceUserClusterSeparation set to true (the default). Upgrade to a patched version as soon as possible.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120807 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120807?: Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.0.48, 8.0.37, 8.3.16, 9.0.7

Ensure X.509 cluster authentication is only enabled when necessary, restrict cluster certificates to known trusted systems, and keep enforceUserClusterSeparation set to true (the default). Upgrade to a patched version as soon as possible.</anigation> </invoke>

Technical details

The vulnerability exists in MongoDB's X.509 cluster-membership authentication guard, which fails to correctly distinguish between a user-not-found error and other transient errors (such as lock timeouts or replication state changes) during user cache lookup. An attacker possessing a valid cluster-member TLS certificate can trigger this logic flaw during a narrow timing window, causing the separation check to be bypassed and granting full internal system privileges. The fix requires treating non-UserNotFound lookup errors as authentication failures rather than treating all errors uniformly as "user absent."

Affected products

MongoDB MongoDB Server 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.2.x, 8.3.x before 8.3.16, 9.0.x before 9.0.7

Timeline

2026-11-10: disclosed

References

https://jira.mongodb.org/browse/SERVER-130169

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.