---
id: "CVE-2026-120804"
page: "https://infrastack.ai/live/CVE-2026-120804"
kind: "vulnerability"
aliases: ["CVE-2026-120804"]
title: "MongoDB Server on Windows: unauthenticated Kerberos (SSPI) login attempts leak credential handles until restart"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "MongoDB Server (Windows Enterprise)", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": ">= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterprise", "kerberos", "mongodb", "runtime", "self-hosted", "windows"]
not_affected_if: ["community-edition", "kerberos-disabled", "kerberos-not-enabled", "linux", "macos", "managed-hosting", "non-windows"]
published_at: "2026-11-10T20:18:50+00:00"
first_seen_at: "2026-11-10T20:46:01+00:00"
updated_at: "2026-11-10T21:04:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120804", "first_seen_at": "2026-11-10T20:46:01+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-130268", "first_seen_at": "2026-11-10T21:04:13+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-130268", "https://hol.org/guard/security/cves/CVE-2026-120804-credential-handle-retention-via-missing-flag-set"]}]
exploit_sources: []
---

# MongoDB Server on Windows: unauthenticated Kerberos (SSPI) login attempts leak credential handles until restart

Link for people: https://infrastack.ai/live/CVE-2026-120804 (this .md is for agents)

On Windows Enterprise builds of MongoDB, the server-side SSPI Kerberos authentication handler fails to release a system resource when processing certain requests. Repeated unauthenticated Kerberos authentication requests exhaust that resource, so later Kerberos logins fail until the server is restarted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB affected range not listed fixed no fixed version listed
- vendor:MongoDB Server (Windows Enterprise) affected >= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7 fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

Only Windows Enterprise builds of mongod/mongos with Kerberos (GSSAPI/SSPI) authentication enabled are affected. Run 'mongod --version' and look for 'modules: enterprise' and a Windows build; check the config for authenticationMechanisms containing GSSAPI. Then compare to: 7.0.x < 7.0.48, 8.0.x < 8.0.37, 8.3.x < 8.3.16, 9.0.x < 9.0.7. If you run 8.2 or other lines not listed, check MongoDB's security bulletins.

## Fix

Upgrade to MongoDB 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (per SERVER-130268). Restart mongod to recover a server whose Kerberos logins already fail.

## Timeline

- 2026-11-10T20:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120804
- 2026-11-10T21:04:13+00:00 analyst https://jira.mongodb.org/browse/SERVER-130268 — MongoDB Jira SERVER-130268 (maintainer) gives fix versions 8.3.16, 9.0.7, 8.0.37, 7.0.48 and root cause (haveCred never set, one SSPI credential handle leaked per unauthenticated saslStart). Affected ranges come from the CVE record via HOL mirror, not MongoDB's page; Jira lists no Affects Version. 8.2 backport was requested but no 8.2 fix version is listed. NVD page returned empty. No exploitation or PoC seen.

## Documents

- [advisory] SERVER-130268: Windows SSPI GSSAPI server plugin never sets haveCred (MongoDB Jira) https://jira.mongodb.org/browse/SERVER-130268
- [describes] HOL Guard record for CVE-2026-120804 (CVE list mirror) https://hol.org/guard/security/cves/CVE-2026-120804-credential-handle-retention-via-missing-flag-set

## From the sources

A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_