{"id":"CVE-2026-120804","kind":"vulnerability","aliases":["CVE-2026-120804"],"related":[],"title":"MongoDB Server on Windows: unauthenticated Kerberos (SSPI) login attempts leak credential handles until restart","description":"A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.","summary":"On Windows Enterprise builds of MongoDB, the server-side SSPI Kerberos authentication handler fails to release a system resource when processing certain requests. Repeated unauthenticated Kerberos authentication requests exhaust that resource, so later Kerberos logins fail until the server is restarted.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"MongoDB Server (Windows Enterprise)","fixed":["7.0.48","8.0.37","8.3.16","9.0.7"],"affected":">= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise","kerberos","mongodb","runtime","self-hosted","windows"],"not_affected_if":["community-edition","kerberos-disabled","kerberos-not-enabled","linux","macos","managed-hosting","non-windows"],"how_to_check":"Only Windows Enterprise builds of mongod/mongos with Kerberos (GSSAPI/SSPI) authentication enabled are affected. Run 'mongod --version' and look for 'modules: enterprise' and a Windows build; check the config for authenticationMechanisms containing GSSAPI. Then compare to: 7.0.x < 7.0.48, 8.0.x < 8.0.37, 8.3.x < 8.3.16, 9.0.x < 9.0.7. If you run 8.2 or other lines not listed, check MongoDB's security bulletins.","fix":"Upgrade to MongoDB 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (per SERVER-130268). Restart mongod to recover a server whose Kerberos logins already fail.","status":"open","published_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:35+00:00","updated_at":"2026-11-10T21:04:13+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T20:47:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB: Windows SSPI Kerberos handler leaks resources, blocking later logins until restart","impact":"medium","summary":"On Windows Enterprise builds of MongoDB, the server-side SSPI Kerberos authentication handler fails to release a system resource when processing certain requests. Repeated unauthenticated Kerberos authentication requests exhaust that resource, so later Kerberos logins fail until the server is restarted.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","windows","kerberos"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Kerberos logins fail until the MongoDB server restarts; denial of service","analyst_note":"Confirm affected and fixed MongoDB versions and whether Kerberos over SSPI must be enabled, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120804 and MongoDB's advisory.","how_to_check":"- Check whether the server runs MongoDB on Windows Enterprise builds.\n- Check whether Kerberos (SSPI) authentication is enabled on the deployment.\n- Check the MongoDB version with `mongod --version` and compare it against the affected ranges (unknown in the sources).","plain_action":"","product_name":"MongoDB","needs_analyst":true,"not_affected_if":["non-windows","kerberos-disabled"],"who_is_affected":"Only MongoDB servers on Windows Enterprise builds that accept Kerberos authentication through SSPI are exposed. Deployments on Linux or macOS, or ones that do not use Kerberos, are not described as affected. Teams that run MongoDB on Windows with Kerberos should review their version and restart procedure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000803,"input_tokens":4617,"output_tokens":683,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected and fixed MongoDB versions and whether Kerberos over SSPI must be enabled, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120804 and MongoDB's advisory.","search":"'-120804':17A,20A '-2026':16A,19A 'attempt':9A,140C 'authent':46B,61B,86C,97C,124C,139C 'avail':132C 'build':37B,91C 'caus':135C 'certain':56B,96C 'credenti':11A 'cve':15A,18A 'due':109C 'enterpris':26B,36B,90C 'enterprise':25A 'error':114C 'eventu':130C 'exhaust':63B,131C 'exist':78C 'fail':48B,70B,101C,142C 'flaw':77C 'handl':12A 'handler':47B,87C 'host':32B 'intern':112C 'kerbero':6A,27B,45B,60B,68B,85C,128C,138C 'later':67B 'leak':10A 'login':8A,69B 'mechan':129C 'mongodb':1A,21A,22A,28B,39B,93C 'process':55B,95C 'proper':103C 'recov':148C 'releas':50B,104C 'repeat':58B,122C 'request':57B,62B,98C,125C 'requir':146C 'resourc':53B,65B,108C,133C 'restart':14A,75B,144C 'runtim':29B 'self':31B 'self-host':30B 'send':123C 'server':2A,23A,42B,73B,82C,100C,143C 'server-sid':41B,81C 'side':43B,83C 'sspi':7A,44B,84C 'subsequ':137C 'system':52B,107C 'track':113C 'trigger':119C 'unauthent':5A,59B,116C 'under':106C 'use':126C 'user':117C 'window':4A,33B,35B,89C 'windows':24A","nicknames":[],"mitigations":[],"who_affected":"Only MongoDB servers on Windows Enterprise builds that accept Kerberos authentication through SSPI are exposed. Deployments on Linux or macOS, or ones that do not use Kerberos, are not described as affected. Teams that run MongoDB on Windows with Kerberos should review their version and restart procedure.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:04:13Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-130268","run_id":2743}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mongodb","mongodbserverwindowsenterprise","serverwindowsenterprise"],"ptokens":["enterprise","mongodb","server","windows"],"labels":["enterprise","high","kerberos","mongodb","runtime","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-120804':17A,20A '-2026':16A,19A 'attempt':9A 'credenti':11A 'cve':15A,18A 'enterprise':25A 'handl':12A 'kerbero':6A 'leak':10A 'login':8A 'mongodb':1A,21A,22A 'restart':14A 'server':2A,23A 'sspi':7A 'unauthent':5A 'window':4A 'windows':24A","search_b":"'authent':46B,61B 'build':37B 'certain':56B 'enterpris':26B,36B 'exhaust':63B 'fail':48B,70B 'handler':47B 'host':32B 'kerbero':27B,45B,60B,68B 'later':67B 'login':69B 'mongodb':28B,39B 'process':55B 'releas':50B 'repeat':58B 'request':57B,62B 'resourc':53B,65B 'restart':75B 'runtim':29B 'self':31B 'self-host':30B 'server':42B,73B 'server-sid':41B 'side':43B 'sspi':44B 'system':52B 'unauthent':59B 'window':33B,35B","search_c":"'attempt':140C 'authent':86C,97C,124C,139C 'avail':132C 'build':91C 'caus':135C 'certain':96C 'due':109C 'enterpris':90C 'error':114C 'eventu':130C 'exhaust':131C 'exist':78C 'fail':101C,142C 'flaw':77C 'handler':87C 'intern':112C 'kerbero':85C,128C,138C 'mechan':129C 'mongodb':93C 'process':95C 'proper':103C 'recov':148C 'releas':104C 'repeat':122C 'request':98C,125C 'requir':146C 'resourc':108C,133C 'restart':144C 'send':123C 'server':82C,100C,143C 'server-sid':81C 'side':83C 'sspi':84C 'subsequ':137C 'system':107C 'track':113C 'trigger':119C 'unauthent':116C 'under':106C 'use':126C 'user':117C 'window':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120804","severity":null,"published_at":"2026-11-10T20:18:50+00:00","modified_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120804:2743","url":"https://jira.mongodb.org/browse/SERVER-130268","severity":null,"published_at":"2026-11-10T21:04:13+00:00","modified_at":"2026-11-10T21:04:13+00:00","first_seen_at":"2026-11-10T21:04:13+00:00","fetched_at":"2026-11-10T21:04:13+00:00","note":"MongoDB Jira SERVER-130268 (maintainer) gives fix versions 8.3.16, 9.0.7, 8.0.37, 7.0.48 and root cause (haveCred never set, one SSPI credential handle leaked per unauthenticated saslStart). Affected ranges come from the CVE record via HOL mirror, not MongoDB's page; Jira lists no Affects Version. 8.2 backport was requested but no 8.2 fix version is listed. NVD page returned empty. No exploitation or PoC seen.","cites":["https://jira.mongodb.org/browse/SERVER-130268","https://hol.org/guard/security/cves/CVE-2026-120804-credential-handle-retention-via-missing-flag-set"]}],"documents":[{"id":118506,"url":"https://jira.mongodb.org/browse/SERVER-130268","title":"SERVER-130268: Windows SSPI GSSAPI server plugin never sets haveCred (MongoDB Jira)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118507,"url":"https://hol.org/guard/security/cves/CVE-2026-120804-credential-handle-retention-via-missing-flag-set","title":"HOL Guard record for CVE-2026-120804 (CVE list mirror)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}