{"id":"CVE-2026-120810","kind":"vulnerability","aliases":["CVE-2026-120810"],"related":[],"title":"MongoDB: authenticated read users can crash the server via aggregation","description":"An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending specially crafted aggregate commands using an internal expression. Despite its internal naming, this expression is registered as accessible to any authenticated client. By supplying crafted input parameters across multiple concurrent connections, each evaluation triggers unbounded memory allocations with no per-expression memory limits enforced. This can exhaust available server memory and cause the mongod process to be terminated by the operating system’s out-of-memory killer.","summary":"An internal aggregation expression in MongoDB server is callable by any authenticated client, so a user with read access can send crafted aggregate commands over several connections. Each evaluation allocates memory without limit, which can exhaust server memory and get the mongod process killed by the operating system.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB server","fixed":["7.0.48","8.0.37","8.3.16","9.0.7"],"affected":">= 7.0.0, < 7.0.48 || >= 8.0.0, < 8.0.37 || >= 8.3.0, < 8.3.16 || >= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","denial-of-service","infrastructure","mongodb","self-hosted"],"not_affected_if":["auth-required","patched-version"],"how_to_check":"Run db.version() in mongosh. You are in the affected range if you run >=7.0.0 <7.0.48, >=8.0.0 <8.0.37, >=8.3.0 <8.3.16 or >=9.0.0 <9.0.7 (ranges from the CVE record as mirrored by HOL; MongoDB's Jira lists only fix versions). Then list accounts with read privileges on the deployment: any authenticated user with read access can trigger it. Atlas or other managed deployments: check with your provider whether they have patched.","fix":"Upgrade MongoDB Server to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (per SERVER-132430). The fix bounds memory of the internal $_internalKeyStringValue expression via a new parameter internalQueryKeyStringValueMaxCollationBytes (settable at startup and runtime).","status":"open","published_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:47:52+00:00","updated_at":"2026-11-10T21:01:59+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T20:47:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB: authenticated read users can crash the server via aggregation","impact":"medium","summary":"An internal aggregation expression in MongoDB server is callable by any authenticated client, so a user with read access can send crafted aggregate commands over several connections. Each evaluation allocates memory without limit, which can exhaust server memory and get the mongod process killed by the operating system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"mongod process killed by out-of-memory killer, causing denial of service","analyst_note":"Check the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-120810 and MongoDB's security advisory for affected and fixed versions.","how_to_check":"- Run `db.version()` in mongosh to get the MongoDB server version and compare it with the fixed versions in the sources.\n- Confirm which accounts have read privileges on your deployments; the flaw needs one of them.","plain_action":"","product_name":"MongoDB server","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Any MongoDB server where users can authenticate with read privileges can trigger the memory exhaustion, so the exposure is about who holds read accounts rather than public internet access. The sources do not list affected version ranges. Deployments where only fully trusted administrators can log in are lower risk.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4630,"output_tokens":585,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-120810 and MongoDB's security advisory for affected and fixed versions.","search":"'-120810':13A,16A '-2026':12A,15A 'access':47B,117C 'across':127C 'aggreg':10A,31B,51B,83C,102C 'alloc':58B,136C 'allow':85C 'authent':2A,40B,87C,120C 'avail':148C 'callabl':37B 'caus':93C,152C 'client':41B,121C 'command':52B,103C 'concurr':129C 'connect':55B,130C 'craft':50B,101C,124C 'crash':6A 'cve':11A,14A 'databas':19B 'denial':21B,95C 'denial-of-servic':20B 'despit':108C 'enforc':144C 'evalu':57B,132C 'exhaust':64B,147C 'express':32B,107C,113C,141C 'framework':84C 'get':68B 'host':28B 'infrastructur':24B 'input':125C 'intern':30B,106C,110C 'issu':78C 'kill':72B 'killer':168C 'limit':61B,143C 'memori':59B,66B,135C,142C,150C,167C 'mongod':70B,154C 'mongodb':1A,17A,25B,34B,80C 'multipl':128C 'name':111C 'oper':75B,161C 'out-of-memori':164C 'paramet':126C 'per':140C 'per-express':139C 'privileg':91C 'process':71B,155C 'read':3A,46B,90C 'regist':115C 'self':27B 'self-host':26B 'send':49B,99C 'server':8A,18A,35B,65B,81C,149C 'servic':23B,97C 'sever':54B 'special':100C 'suppli':123C 'system':76B,162C 'termin':158C 'trigger':133C 'unbound':134C 'use':104C 'user':4A,44B,88C 'via':9A 'without':60B","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB servers (mongod) on 7.0, 8.0, 8.3 and 9.0 before the fixed versions, where any untrusted or low-trust account has read access. The flaw is the $_internalKeyStringValue aggregation expression, which despite its name is callable by any authenticated client and has no memory limit; several concurrent connections can exhaust memory until the OS OOM killer ends mongod. Deployments where only fully trusted clients can authenticate carry little risk; unauthenticated access is not described.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:01:59Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-132430","run_id":2740}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["database","denialofservice","high","infrastructure","mongodb","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120810':13A,16A '-2026':12A,15A 'aggreg':10A 'authent':2A 'crash':6A 'cve':11A,14A 'mongodb':1A,17A 'read':3A 'server':8A,18A 'user':4A 'via':9A","search_b":"'access':47B 'aggreg':31B,51B 'alloc':58B 'authent':40B 'callabl':37B 'client':41B 'command':52B 'connect':55B 'craft':50B 'databas':19B 'denial':21B 'denial-of-servic':20B 'evalu':57B 'exhaust':64B 'express':32B 'get':68B 'host':28B 'infrastructur':24B 'intern':30B 'kill':72B 'limit':61B 'memori':59B,66B 'mongod':70B 'mongodb':25B,34B 'oper':75B 'process':71B 'read':46B 'self':27B 'self-host':26B 'send':49B 'server':35B,65B 'servic':23B 'sever':54B 'system':76B 'user':44B 'without':60B","search_c":"'access':117C 'across':127C 'aggreg':83C,102C 'alloc':136C 'allow':85C 'authent':87C,120C 'avail':148C 'caus':93C,152C 'client':121C 'command':103C 'concurr':129C 'connect':130C 'craft':101C,124C 'denial':95C 'despit':108C 'enforc':144C 'evalu':132C 'exhaust':147C 'express':107C,113C,141C 'framework':84C 'input':125C 'intern':106C,110C 'issu':78C 'killer':168C 'limit':143C 'memori':135C,142C,150C,167C 'mongod':154C 'mongodb':80C 'multipl':128C 'name':111C 'oper':161C 'out-of-memori':164C 'paramet':126C 'per':140C 'per-express':139C 'privileg':91C 'process':155C 'read':90C 'regist':115C 'send':99C 'server':81C,149C 'servic':97C 'special':100C 'suppli':123C 'system':162C 'termin':158C 'trigger':133C 'unbound':134C 'use':104C 'user':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120810","severity":null,"published_at":"2026-11-10T20:18:51+00:00","modified_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120810:2740","url":"https://jira.mongodb.org/browse/SERVER-132430","severity":null,"published_at":"2026-11-10T21:01:59+00:00","modified_at":"2026-11-10T21:01:59+00:00","first_seen_at":"2026-11-10T21:01:59+00:00","fetched_at":"2026-11-10T21:01:59+00:00","note":"Fix versions read on MongoDB Jira SERVER-132430 (vendor); affected ranges from CVE record via HOL mirror, not verified. No exploitation or PoC found; no discussion searched (new, low-profile).","cites":["https://jira.mongodb.org/browse/SERVER-132430","https://hol.org/guard/security/cves/CVE-2026-120810-uncontrolled-resource-consumption-in-mongodb"]}],"documents":[{"id":118476,"url":"https://jira.mongodb.org/browse/SERVER-132430","title":"SERVER-132430: Bound memory usage in ","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118477,"url":"https://hol.org/guard/security/cves/CVE-2026-120810-uncontrolled-resource-consumption-in-mongodb","title":"HOL Guard record CVE-2026-120810","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}