---
id: "CVE-2026-120810"
page: "https://infrastack.ai/live/CVE-2026-120810"
kind: "vulnerability"
aliases: ["CVE-2026-120810"]
title: "MongoDB: authenticated read users can crash the server via aggregation"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "MongoDB server", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": ">= 7.0.0, < 7.0.48 || >= 8.0.0, < 8.0.37 || >= 8.3.0, < 8.3.16 || >= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["database", "denial-of-service", "infrastructure", "mongodb", "self-hosted"]
not_affected_if: ["auth-required", "patched-version"]
published_at: "2026-11-10T20:18:51+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T21:01:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120810", "first_seen_at": "2026-11-10T20:46:02+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-132430", "first_seen_at": "2026-11-10T21:01:59+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-132430", "https://hol.org/guard/security/cves/CVE-2026-120810-uncontrolled-resource-consumption-in-mongodb"]}]
exploit_sources: []
---

# MongoDB: authenticated read users can crash the server via aggregation

Link for people: https://infrastack.ai/live/CVE-2026-120810 (this .md is for agents)

An internal aggregation expression in MongoDB server is callable by any authenticated client, so a user with read access can send crafted aggregate commands over several connections. Each evaluation allocates memory without limit, which can exhaust server memory and get the mongod process killed by the operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB server affected >= 7.0.0, < 7.0.48 || >= 8.0.0, < 8.0.37 || >= 8.3.0, < 8.3.16 || >= 9.0.0, < 9.0.7 fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

Run db.version() in mongosh. You are in the affected range if you run >=7.0.0 <7.0.48, >=8.0.0 <8.0.37, >=8.3.0 <8.3.16 or >=9.0.0 <9.0.7 (ranges from the CVE record as mirrored by HOL; MongoDB's Jira lists only fix versions). Then list accounts with read privileges on the deployment: any authenticated user with read access can trigger it. Atlas or other managed deployments: check with your provider whether they have patched.

## Fix

Upgrade MongoDB Server to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (per SERVER-132430). The fix bounds memory of the internal $_internalKeyStringValue expression via a new parameter internalQueryKeyStringValueMaxCollationBytes (settable at startup and runtime).

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120810
- 2026-11-10T21:01:59+00:00 analyst https://jira.mongodb.org/browse/SERVER-132430 — Fix versions read on MongoDB Jira SERVER-132430 (vendor); affected ranges from CVE record via HOL mirror, not verified. No exploitation or PoC found; no discussion searched (new, low-profile).

## Documents

- [advisory] SERVER-132430: Bound memory usage in  https://jira.mongodb.org/browse/SERVER-132430
- [describes] HOL Guard record CVE-2026-120810 https://hol.org/guard/security/cves/CVE-2026-120810-uncontrolled-resource-consumption-in-mongodb

## From the sources

An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending specially crafted aggregate commands using an internal expression. Despite its internal naming, this expression is registered as accessible to any authenticated client. By supplying crafted input parameters across multiple concurrent connections, each evaluation triggers unbounded memory allocations with no per-expression memory limits enforced. This can exhaust available server memory and cause the mongod process to be terminated by the operating system’s out-of-memory killer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_