{"id":"CVE-2026-120807","kind":"vulnerability","aliases":["CVE-2026-120807"],"related":[],"title":"MongoDB: X.509 cluster-member check can be bypassed for full internal privileges","description":"A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated internal privileges when a specific deployment configuration is in use. An internal check, which prevents a certificate recognized as a cluster member from also being treated as a regular user, does not correctly distinguish between certain error conditions encountered during user lookup. Under certain timing conditions, this can cause the check to be bypassed, granting the connection full internal system privileges. Triggering this issue requires possession of a valid cluster-member TLS certificate, non-default X.509 cluster authentication configuration, and specific conditions during the user cache lookup process.","summary":"A flaw in MongoDB's X.509 cluster-membership check lets a holder of a valid cluster-member certificate be treated as a regular user during certain user lookup errors. Under specific timing conditions the check can be bypassed, giving the connection full internal system privileges.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongodb-server","fixed":["7.0.48","8.0.37","8.3.16","9.0.7"],"affected":">=7.0.0 <7.0.48 || >=8.0.0 <8.0.37 || >=8.3.0 <8.3.16 || >=9.0.0 <9.0.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","infrastructure","mongodb","privilege-escalation","self-hosted","x509"],"not_affected_if":["default-config","keyfile-auth","managed-hosting","no-cluster-member-certs"],"how_to_check":"1) Run 'mongod --version' and compare with 9.0.7 / 8.3.16 / 8.0.37 / 7.0.48. 2) You are only exposed if you use X.509 cluster (internal) authentication with extension-based membership (net.tls.clusterAuthX509.extensionValue in mongod.conf, clusterAuthMode x509 or sendX509) and enforceUserClusterSeparation is true. Keyfile-only clusters are not in the reproduction conditions. 3) The attacker needs a valid cluster-member certificate.","fix":"Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later) on your branch. Fix makes the X.509 separation check fail closed on any user-lookup error other than UserNotFound. MongoDB lists no fixed version for 8.2 in the ticket; move to a listed branch.","status":"open","published_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:47:49+00:00","updated_at":"2026-11-10T21:02:09+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T20:47:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB: X.509 cluster-member check can be bypassed for full internal privileges","impact":"high","summary":"A flaw in MongoDB's X.509 cluster-membership check lets a holder of a valid cluster-member certificate be treated as a regular user during certain user lookup errors. Under specific timing conditions the check can be bypassed, giving the connection full internal system privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains full internal system privileges on the MongoDB cluster.","analyst_note":"Confirm affected version ranges and fixed versions from the MongoDB advisory or NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120807.","how_to_check":"- Look for non-default X.509 cluster authentication settings in the MongoDB configuration file (`mongod.conf`, under `security`).\n- Check the running version with `mongod --version` and compare it against the fixed versions in the sources.\n- unknown for the exact affected version ranges, as the sources do not list them.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-cluster-member-certs"],"who_is_affected":"Only deployments that use non-default X.509 cluster authentication are described as affected, and the attacker must already hold a valid cluster-member TLS certificate. Standalone or default-configured MongoDB instances are not described as exposed. Teams running MongoDB replica sets or sharded clusters with custom X.509 settings should review them first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4678,"output_tokens":629,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected version ranges and fixed versions from the MongoDB advisory or NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120807.","search":"'-120807':16A,19A '-2026':15A,18A 'allow':92C 'also':127C 'authent':89C,183C 'bypass':9A,72B,157C 'cach':191C 'caus':152C 'certain':60B,139C,147C 'certif':52B,100C,120C,177C 'check':6A,42B,69B,116C,154C 'cluster':4A,40B,50B,87C,98C,124C,174C,182C 'cluster-memb':3A,49B,97C,173C 'cluster-membership':39B,86C 'condit':67B,141C,149C,187C 'configur':110C,184C 'connect':75B,160C 'correct':136C 'could':91C 'cve':14A,17A 'databas':23B 'default':180C 'deploy':109C 'distinguish':137C 'elev':103C 'encount':142C 'error':63B,140C 'escal':28B 'flaw':34B,81C 'full':11A,76B,161C 'gain':102C 'give':73B 'grant':158C 'guard':90C 'holder':45B,94C 'host':31B 'infrastructur':24B 'intern':12A,77B,104C,115C,162C 'issu':167C 'let':43B 'lookup':62B,145C,192C 'member':5A,51B,99C,125C,175C 'membership':41B,88C 'mongodb':1A,21A,25B,36B,83C 'mongodb-server':20A 'non':179C 'non-default':178C 'possess':169C 'prevent':118C 'privileg':13A,27B,79B,105C,164C 'privilege-escal':26B 'process':193C 'recogn':121C 'regular':57B,132C 'requir':168C 'self':30B 'self-host':29B 'server':22A 'specif':65B,108C,186C 'system':78B,163C 'time':66B,148C 'tls':176C 'treat':54B,129C 'trigger':165C 'use':113C 'user':58B,61B,133C,144C,190C 'valid':48B,172C 'x.509':2A,38B,85C,181C 'x509':32B","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB 7.0, 8.0, 8.3 and 9.0 deployments that use X.509 certificates with a non-default cluster-membership configuration (certificate extension value). Exploiting it takes a valid cluster-member TLS certificate and a failing user lookup at the right moment, which gives the connection full internal privileges. Skip if you use keyfile cluster auth, no X.509 membership, or a managed service where the vendor patches.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:02:09Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-130169","run_id":2741}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver"],"ptokens":["mongodb","server"],"labels":["database","high","infrastructure","mongodb","privilegeescalation","selfhosted","x509"],"campaign_type":null,"search_a":"'-120807':16A,19A '-2026':15A,18A 'bypass':9A 'check':6A 'cluster':4A 'cluster-memb':3A 'cve':14A,17A 'full':11A 'intern':12A 'member':5A 'mongodb':1A,21A 'mongodb-server':20A 'privileg':13A 'server':22A 'x.509':2A","search_b":"'bypass':72B 'certain':60B 'certif':52B 'check':42B,69B 'cluster':40B,50B 'cluster-memb':49B 'cluster-membership':39B 'condit':67B 'connect':75B 'databas':23B 'error':63B 'escal':28B 'flaw':34B 'full':76B 'give':73B 'holder':45B 'host':31B 'infrastructur':24B 'intern':77B 'let':43B 'lookup':62B 'member':51B 'membership':41B 'mongodb':25B,36B 'privileg':27B,79B 'privilege-escal':26B 'regular':57B 'self':30B 'self-host':29B 'specif':65B 'system':78B 'time':66B 'treat':54B 'user':58B,61B 'valid':48B 'x.509':38B 'x509':32B","search_c":"'allow':92C 'also':127C 'authent':89C,183C 'bypass':157C 'cach':191C 'caus':152C 'certain':139C,147C 'certif':100C,120C,177C 'check':116C,154C 'cluster':87C,98C,124C,174C,182C 'cluster-memb':97C,173C 'cluster-membership':86C 'condit':141C,149C,187C 'configur':110C,184C 'connect':160C 'correct':136C 'could':91C 'default':180C 'deploy':109C 'distinguish':137C 'elev':103C 'encount':142C 'error':140C 'flaw':81C 'full':161C 'gain':102C 'grant':158C 'guard':90C 'holder':94C 'intern':104C,115C,162C 'issu':167C 'lookup':145C,192C 'member':99C,125C,175C 'membership':88C 'mongodb':83C 'non':179C 'non-default':178C 'possess':169C 'prevent':118C 'privileg':105C,164C 'process':193C 'recogn':121C 'regular':132C 'requir':168C 'specif':108C,186C 'system':163C 'time':148C 'tls':176C 'treat':129C 'trigger':165C 'use':113C 'user':133C,144C,190C 'valid':172C 'x.509':85C,181C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120807","severity":null,"published_at":"2026-11-10T20:18:51+00:00","modified_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120807:2741","url":"https://jira.mongodb.org/browse/SERVER-130169","severity":null,"published_at":"2026-11-10T21:02:09+00:00","modified_at":"2026-11-10T21:02:09+00:00","first_seen_at":"2026-11-10T21:02:09+00:00","fetched_at":"2026-11-10T21:02:09+00:00","note":"Read MongoDB Jira SERVER-130169 (fix versions 9.0.7, 8.3.16, 8.0.37, 7.0.48; root cause, repro conditions). Affected ranges from HOL Guard's CVE record (secondary), consistent with Jira fix list. No exploitation or PoC seen; no social search done. 8.2 had backport requested but no fixed version listed.","cites":["https://jira.mongodb.org/browse/SERVER-130169","https://hol.org/guard/security/cves/CVE-2026-120807-privilege-escalation-via-fail-open-user-lookup-in"]}],"documents":[{"id":118480,"url":"https://jira.mongodb.org/browse/SERVER-130169","title":"SERVER-130169 fail-open user lookup in X.509 separation check (MongoDB Jira)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118481,"url":"https://hol.org/guard/security/cves/CVE-2026-120807-privilege-escalation-via-fail-open-user-lookup-in","title":"HOL Guard record for CVE-2026-120807 (CVE description, affected ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}