Do Son 
TL;DR
MongoDB released version 9.0.7 and six maintenance updates to fix 26 security bugs in MongoDB Server. Led by two critical flaws, CVE-2026-118383 (CVSS 9.5) and CVE-2026-120808 (CVSS 9.1), the bugs allow code execution, traffic snooping, and crashes. Database admins must update their clusters right away to protect stored records.
- Total: 26 CVEs
- Severity: 2 Critical · 16 High · 8 Medium
- Actively exploited: None confirmed
- Highest severity: 9.5 (Critical · CVSSv4) — CVE-2026-118383
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-118383 | 9.5 | Pre-authentication use-after-free in replica set primary catch-up | 9.0.7, 8.3.16, 8.0.37 (+4) | Not exploited |
| CVE-2026-120808 | 9.1 | Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client | 9.0.7, 8.3.16, 8.0.37 (+1) | Not exploited |
| CVE-2026-120824 | 8.7 | Post-authentication use-after-free in time-series bucket validation | 9.0.7, 8.3.16, 8.0.37 (+1) | Not exploited |
| CVE-2026-120828 | 8.7 | Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage | 9.0.7, 8.3.16, 8.0.37 (+4) | Not exploited |
| CVE-2026-120815 | 8.6 | Incorrect Authorization Check in Localhost Exception Leads to Unauthorized Administrative Access | 9.0.7, 8.3.16, 8.0.37 (+1) | Not exploited |
| CVE-2026-120822 | 8.6 | Missing Authorization Check in Replication-Related Administrative Command Leads to Unauthorized Data Access | 9.0.7, 8.3.16, 8.0.37 (+1) | Not exploited |
| CVE-2026-120804 | 8.2 | Credential-handle retention via missing flag set in Windows Kerberos auth handler | 9.0.7, 8.3.16, 8.0.37 (+1) | Not exploited |
| CVE-2026-120813 | 8.2 | Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing | 9.0.7, 8.3.16, 8.0.37 (+1) | Not exploited |
Why It Matters
MongoDB Server runs core app databases and cloud clusters for firms around the world. Because the worst flaw triggers with no login during replica set elections, exposed nodes face high takeover risks.
Currently, neither source reports any active attacks in the wild or public exploit code for these bugs. Internal devs found 14 of the flaws, while outside researchers reported the other 12 issues. While exact version counts remain private, over 50,000 firms and millions of coders run MongoDB globally.
How the Attack Works
Critical Replica Set and macOS TLS Flaws
First, CVE-2026-118383 (CVSS 9.5) is a use-after-free bug (CWE-416) in the replication code. The error happens when a newly elected replica set primary finishes its catch-up step. An unauthenticated attacker can send network requests that crash the host or run arbitrary code. This flaw hits replica set members, shard nodes, and config servers, though standalone mongod hosts are safe.
Second, CVE-2026-120808 (CVSS 9.1) breaks cert checks (CWE-295) on macOS builds that use the Apple SecureTransport TLS tool. When a process connects to an IPv6 peer, it drops the trust result from SecTrustEvaluate. Consequently, an on-path attacker can use a self-signed IPv6 cert to intercept and alter encrypted traffic.
Memory Corruption and Resource Exhaustion
Third, seven more use-after-free bugs (CWE-416) hit query and time-series tools. Specifically, CVE-2026-120824 (CVSS 8.7) lets users with bucket write rights crash the server or run code during bucket checks. Meanwhile, CVE-2026-120821 (CVSS 7.1) crashes sub-pipelines, and CVE-2026-120803 (CVSS 7.1) leaks heap memory via the $locf window accumulator.
Other use-after-free bugs leak process memory through JavaScript queries (CVE-2026-120818, CVSS 7.1) and time-series block unpacking (CVE-2026-120809, CVSS 6.1). They also leak memory via the classic plan cache (CVE-2026-120811, CVSS 6.0) and the Wasm bridge (CVE-2026-120819, CVSS 5.3). Furthermore, attackers can drain memory without credentials using far-future read-concern waiters (CVE-2026-120828, CVSS 8.7) or Windows Kerberos handle leaks (CVE-2026-120804, CVSS 8.2). Logged-in users can also trigger crashes via internal expressions (CVE-2026-120810), geospatial race bugs (CVE-2026-120817), query recursion (CVE-2026-120812), and encrypted stats tables (CVE-2026-120820).
Authorization Bypasses and Encryption Flaws
Fourth, 11 bugs weaken access rules and encryption checks. In CVE-2026-120815 (CVSS 8.6), a flaw in the localhost exception lets a local user gain full admin rights. Similarly, CVE-2026-120822 (CVSS 8.6) lets backup users read and move restricted collections. In addition, CVE-2026-120813 (CVSS 8.2) causes CSFLE clients to drop encryption rules and store secrets in plain text.
Moreover, shard admins can replay state to create a cluster root user (CVE-2026-120814, CVSS 7.5), and X.509 lookup errors grant system rights (CVE-2026-120807, CVSS 7.5). Basic users can also bypass view checks to read other databases or collections (CVE-2026-120826 and CVE-2026-120825, CVSS 7.1). Finally, CVE-2026-120806 (CVSS 7.0) leaves stale role links when dropping roles, while three low-risk bugs (CVE-2026-120823, CVE-2026-120816, and CVE-2026-120805) expose config data, change streams, or FLE2 state writes.
Affected Versions
These flaws hit MongoDB Server branches 9.0 before 9.0.7, 8.3 before 8.3.16, 8.0 before 8.0.37, and 7.0 before 7.0.48. In addition, CVE-2026-118383 and CVE-2026-120828 affect older branches 6.0 before 6.0.30, 5.0 before 5.0.35, and 4.4 before 4.4.32.
Patch and Mitigation Steps
Admins should update MongoDB Server to versions 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, or 4.4.32 right away. Furthermore, teams should limit database network access to trusted app hosts and check custom view rules. Finally, admins should audit user roles after dropping roles from a database.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
