{"id":"CVE-2026-120805","kind":"vulnerability","aliases":["CVE-2026-120805"],"related":[],"title":"MongoDB Server: insert-only user can corrupt another collection's encryption metadata","description":"In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations.","summary":"An authenticated user who has insert rights on one collection can craft a command with special encryption parameters so that internal Queryable Encryption metadata writes land on other encrypted collections in the same database. The attacker can corrupt encrypted index state and compaction operations for those collections.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mongodb","queryable-encryption","runtime","self-hosted"],"not_affected_if":["auth-required","no-queryable-encryption"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:48:13+00:00","updated_at":"2026-11-10T20:48:13+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T20:48:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: insert-only user can corrupt another collection's encryption metadata","impact":"medium","summary":"An authenticated user who has insert rights on one collection can craft a command with special encryption parameters so that internal Queryable Encryption metadata writes land on other encrypted collections in the same database. The attacker can corrupt encrypted index state and compaction operations for those collections.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","queryable-encryption","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated insert user corrupts other collections' encrypted metadata and compaction","analyst_note":"Find the affected and fixed MongoDB Server versions and the vendor advisory (NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-120805 lists none).","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","no-queryable-encryption"],"who_is_affected":"Teams running self-managed MongoDB Server that use Queryable Encryption and have users with insert privileges on at least one collection are the exposed group. Deployments that do not use Queryable Encryption, or where all users are fully trusted, are less exposed. The sources do not list affected or fixed versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4654,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120805':16A,19A '-2026':15A,18A 'allow':155C 'anoth':9A,159C 'attack':63B 'authent':29B,79C 'author':119C 'belong':107C 'bypass':146C 'caller':149C 'client':137C 'client-suppli':136C 'collect':10A,37B,57B,74B,86C,111C,128C,160C 'command':41B,90C 'compact':70B,171C 'construct':93C 'corrupt':8A,65B,166C 'could':87C,154C 'craft':39B,88C 'cve':14A,17A 'databas':61B,115C 'deriv':134C 'elev':143C 'encrypt':12A,23B,44B,50B,56B,66B,95C,102C,110C,163C,167C 'encryption-rel':94C 'face':126C 'host':27B 'index':67B,168C 'insert':4A,33B,82C 'insert-on':3A 'intern':48B,100C,132C,144C 'land':53B 'layer':120C 'metadata':13A,51B,103C,106C,164C 'mongodb':1A,20B,76C 'namespac':129C 'one':36B 'oper':71B,172C 'origin':148C 'paramet':45B,97C,139C 'perform':141C 'permiss':151C 'potenti':165C 'privileg':83C,145C 'queryabl':22B,49B,101C,162C 'queryable-encrypt':21B 'redirect':99C 'relat':96C 'right':34B 'runtim':24B 'scope':152C 'self':26B 'self-host':25B 'server':2A,77C,117C 'special':43B,92C 'state':68B,169C 'subsequ':131C 'suppli':138C 'target':127C 'unauthor':156C 'user':6A,30B,80C,125C 'user-fac':124C 'valid':121C 'within':112C 'write':52B,104C,133C,157C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed MongoDB Server that use Queryable Encryption and have users with insert privileges on at least one collection are the exposed group. Deployments that do not use Queryable Encryption, or where all users are fully trusted, are less exposed. The sources do not list affected or fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mongodb","queryableencryption","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120805':16A,19A '-2026':15A,18A 'anoth':9A 'collect':10A 'corrupt':8A 'cve':14A,17A 'encrypt':12A 'insert':4A 'insert-on':3A 'metadata':13A 'mongodb':1A 'server':2A 'user':6A","search_b":"'attack':63B 'authent':29B 'collect':37B,57B,74B 'command':41B 'compact':70B 'corrupt':65B 'craft':39B 'databas':61B 'encrypt':23B,44B,50B,56B,66B 'host':27B 'index':67B 'insert':33B 'intern':48B 'land':53B 'metadata':51B 'mongodb':20B 'one':36B 'oper':71B 'paramet':45B 'queryabl':22B,49B 'queryable-encrypt':21B 'right':34B 'runtim':24B 'self':26B 'self-host':25B 'special':43B 'state':68B 'user':30B 'write':52B","search_c":"'allow':155C 'anoth':159C 'authent':79C 'author':119C 'belong':107C 'bypass':146C 'caller':149C 'client':137C 'client-suppli':136C 'collect':86C,111C,128C,160C 'command':90C 'compact':171C 'construct':93C 'corrupt':166C 'could':87C,154C 'craft':88C 'databas':115C 'deriv':134C 'elev':143C 'encrypt':95C,102C,110C,163C,167C 'encryption-rel':94C 'face':126C 'index':168C 'insert':82C 'intern':100C,132C,144C 'layer':120C 'metadata':103C,106C,164C 'mongodb':76C 'namespac':129C 'oper':172C 'origin':148C 'paramet':97C,139C 'perform':141C 'permiss':151C 'potenti':165C 'privileg':83C,145C 'queryabl':101C,162C 'redirect':99C 'relat':96C 'scope':152C 'server':77C,117C 'special':92C 'state':169C 'subsequ':131C 'suppli':138C 'target':127C 'unauthor':156C 'user':80C,125C 'user-fac':124C 'valid':121C 'within':112C 'write':104C,133C,157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120805","severity":null,"published_at":"2026-11-10T20:18:50+00:00","modified_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}