Is CVE-2026-120817 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120817 being exploited in the wild.

How severe is CVE-2026-120817?

Medium severity, with a CVSS score of 6.5, published 10 November 2026.

Which products and versions are affected?

MongoDB Server 7.0 before 7.0.48, 8.0 before 8.0.37, 8.3 before 8.3.16, 9.0 before 9.0.7.

Is there a fix for CVE-2026-120817?

Yes: fixed in MongoDB Server 7.0.48, 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120817 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-120817?

Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120817: MongoDB Server race condition in schema validation

CVE-2026-120817 · Severity: medium · CVSS 6.5 · Published 2026-11-10

MongoDB Server is a popular database that stores and retrieves business data. When multiple write operations occur simultaneously against a collection with geospatial validation rules, a race condition in the validation component can cause the server to crash unexpectedly. An authenticated user with write permissions can trigger this issue, disrupting database availability.

Technologies: MongoDB Server. Vendors: MongoDB.

Quick answers

Is CVE-2026-120817 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120817 being exploited in the wild.
How severe is CVE-2026-120817?: Medium severity, with a CVSS score of 6.5, published 10 November 2026.
Which products and versions are affected?: MongoDB Server 7.0 before 7.0.48, 8.0 before 8.0.37, 8.3 before 8.3.16, 9.0 before 9.0.7.
Is there a fix for CVE-2026-120817?: Yes: fixed in MongoDB Server 7.0.48, 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120817 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-120817?: Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MongoDB Server 7.0.48, 8.0.37, 8.3.16, 9.0.7

Technical details

A race condition exists in the S2 geospatial library components (S2EdgeIndex::mapping_ and S2Loop::vertex_to_index_) used by MongoDB's schema validation. These data structures contain mutable state modified by const methods, leading to concurrent access violations when multiple writes trigger validation checks. An authenticated attacker with write privileges can cause a denial of service through server termination.

Affected products

MongoDB Server 7.0 before 7.0.48, 8.0 before 8.0.37, 8.3 before 8.3.16, 9.0 before 9.0.7

Timeline

2026-11-10: disclosed
2026-11-10: patched

References

https://jira.mongodb.org/browse/SERVER-135655

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.