MONGODB · CVE-2026-120804 · Runtime
FIX → 9.0.7 · 8.3.16 · 7.0.48 +1 ✓ verified
On Windows Enterprise builds of MongoDB, the server-side SSPI Kerberos authentication handler fails to release a system resource when processing certain requests. Repeated unauthenticated Kerberos authentication requests exhaust that resource, so later Kerberos logins fail until the server is restarted.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only MongoDB servers on Windows Enterprise builds that accept Kerberos authentication through SSPI are exposed. Deployments on Linux or macOS, or ones that do not use Kerberos, are not described as affected. Teams that run MongoDB on Windows with Kerberos should review their version and restart procedure.
Not affected if community-edition, kerberos-disabled, kerberos-not-enabled, linux, macos, managed-hosting, non-windows
Who cares enterprise, kerberos, mongodb, self-hosted, windows
mongod --version and look for modules: enterprise and a Windows build; check the config for authenticationMechanisms containing GSSAPI7.0.48, 8.0.x < 8.0.37, 8.3.x < 8.3.16, 9.0.x < Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.0.7Upgrade to 9.0.7 · 8.3.16 · 7.0.48 +1
9.0.7, 8.3.16, 8.0.37 or 7.0.48 (per SERVER-130268)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.