---
id: "CVE-2026-120805"
page: "https://infrastack.ai/live/CVE-2026-120805"
kind: "vulnerability"
aliases: ["CVE-2026-120805"]
title: "MongoDB Server: insert-only user can corrupt another collection's encryption metadata"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["mongodb", "queryable-encryption", "runtime", "self-hosted"]
not_affected_if: ["auth-required", "no-queryable-encryption"]
published_at: "2026-11-10T20:18:50+00:00"
first_seen_at: "2026-11-10T20:46:01+00:00"
updated_at: "2026-11-10T20:48:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120805", "first_seen_at": "2026-11-10T20:46:01+00:00"}]
exploit_sources: []
---

# MongoDB Server: insert-only user can corrupt another collection's encryption metadata

Link for people: https://infrastack.ai/live/CVE-2026-120805 (this .md is for agents)

An authenticated user who has insert rights on one collection can craft a command with special encryption parameters so that internal Queryable Encryption metadata writes land on other encrypted collections in the same database. The attacker can corrupt encrypted index state and compaction operations for those collections.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120805

## From the sources

In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_