Is CVE-2026-120813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120813 being exploited in the wild.

How severe is CVE-2026-120813?

Medium severity, with a CVSS score of 5.9, published 10 November 2026.

Which products and versions are affected?

MongoDB Server 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.3.x before 8.3.16, 9.0.x before 9.0.7.

Is there a fix for CVE-2026-120813?

Yes: fixed in Server 7.0.48, 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120813 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120813?

Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120813: MongoDB Server client-side field-level encryption schema parsing bypass

CVE-2026-120813 · Severity: medium · CVSS 5.9 · Published 2026-11-10

MongoDB Server's client-side field-level encryption (CSFLE) can silently drop encryption metadata when processing malformed schemas, causing sensitive data to be stored unencrypted. An attacker positioned to intercept or control the schema delivered to a user's CSFLE client—such as through a compromised server or man-in-the-middle attack—can trick the client into storing plaintext data that should be encrypted, defeating the encryption protections entirely.

Technologies: MongoDB Server. Vendors: MongoDB.

Quick answers

Is CVE-2026-120813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120813 being exploited in the wild.
How severe is CVE-2026-120813?: Medium severity, with a CVSS score of 5.9, published 10 November 2026.
Which products and versions are affected?: MongoDB Server 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.3.x before 8.3.16, 9.0.x before 9.0.7.
Is there a fix for CVE-2026-120813?: Yes: fixed in Server 7.0.48, 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120813 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120813?: Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Server 7.0.48, 8.0.37, 8.3.16, 9.0.7

Technical details

The CSFLE schema processing component uses a "last-wins" map assignment for duplicate `properties` keys and "first-wins" set insertion for duplicate `patternProperties` patterns, silently discarding duplicates instead of rejecting them. An attacker can craft a schema with duplicate keys to overwrite or drop encryption directives, causing the client to skip encryption for targeted fields. The vulnerability requires network-level access to deliver the malicious schema to the client.

Affected products

MongoDB Server 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.3.x before 8.3.16, 9.0.x before 9.0.7

Timeline

2026-11-10: disclosed

References

https://jira.mongodb.org/browse/SERVER-132517

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.