---
id: "CVE-2026-120807"
page: "https://infrastack.ai/live/CVE-2026-120807"
kind: "vulnerability"
aliases: ["CVE-2026-120807"]
title: "MongoDB: X.509 cluster-member check can be bypassed for full internal privileges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "mongodb-server", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": ">=7.0.0 <7.0.48 || >=8.0.0 <8.0.37 || >=8.3.0 <8.3.16 || >=9.0.0 <9.0.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database", "infrastructure", "mongodb", "privilege-escalation", "self-hosted", "x509"]
not_affected_if: ["default-config", "keyfile-auth", "managed-hosting", "no-cluster-member-certs"]
published_at: "2026-11-10T20:18:51+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T21:02:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120807", "first_seen_at": "2026-11-10T20:46:02+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-130169", "first_seen_at": "2026-11-10T21:02:09+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-130169", "https://hol.org/guard/security/cves/CVE-2026-120807-privilege-escalation-via-fail-open-user-lookup-in"]}]
exploit_sources: []
---

# MongoDB: X.509 cluster-member check can be bypassed for full internal privileges

Link for people: https://infrastack.ai/live/CVE-2026-120807 (this .md is for agents)

A flaw in MongoDB's X.509 cluster-membership check lets a holder of a valid cluster-member certificate be treated as a regular user during certain user lookup errors. Under specific timing conditions the check can be bypassed, giving the connection full internal system privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mongodb-server affected >=7.0.0 <7.0.48 || >=8.0.0 <8.0.37 || >=8.3.0 <8.3.16 || >=9.0.0 <9.0.7 fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

1) Run 'mongod --version' and compare with 9.0.7 / 8.3.16 / 8.0.37 / 7.0.48. 2) You are only exposed if you use X.509 cluster (internal) authentication with extension-based membership (net.tls.clusterAuthX509.extensionValue in mongod.conf, clusterAuthMode x509 or sendX509) and enforceUserClusterSeparation is true. Keyfile-only clusters are not in the reproduction conditions. 3) The attacker needs a valid cluster-member certificate.

## Fix

Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later) on your branch. Fix makes the X.509 separation check fail closed on any user-lookup error other than UserNotFound. MongoDB lists no fixed version for 8.2 in the ticket; move to a listed branch.

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120807
- 2026-11-10T21:02:09+00:00 analyst https://jira.mongodb.org/browse/SERVER-130169 — Read MongoDB Jira SERVER-130169 (fix versions 9.0.7, 8.3.16, 8.0.37, 7.0.48; root cause, repro conditions). Affected ranges from HOL Guard's CVE record (secondary), consistent with Jira fix list. No exploitation or PoC seen; no social search done. 8.2 had backport requested but no fixed version listed.

## Documents

- [advisory] SERVER-130169 fail-open user lookup in X.509 separation check (MongoDB Jira) https://jira.mongodb.org/browse/SERVER-130169
- [describes] HOL Guard record for CVE-2026-120807 (CVE description, affected ranges) https://hol.org/guard/security/cves/CVE-2026-120807-privilege-escalation-via-fail-open-user-lookup-in

## From the sources

A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated internal privileges when a specific deployment configuration is in use. An internal check, which prevents a certificate recognized as a cluster member from also being treated as a regular user, does not correctly distinguish between certain error conditions encountered during user lookup. Under certain timing conditions, this can cause the check to be bypassed, granting the connection full internal system privileges. Triggering this issue requires possession of a valid cluster-member TLS certificate, non-default X.509 cluster authentication configuration, and specific conditions during the user cache lookup process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_