{"id":"CVE-2026-120811","kind":"vulnerability","aliases":["CVE-2026-120811"],"related":[],"title":"MongoDB: plan cache use-after-free can leak server memory to clients","description":"A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.","summary":"A use-after-free bug in MongoDB's classic query engine plan cache lets a diagnostic command read freed heap memory. An authenticated client may receive sensitive server process memory contents, and under some heap reuse conditions the server can crash.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mongodb","package","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:48:12+00:00","updated_at":"2026-11-10T20:48:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T20:48:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB: plan cache use-after-free can leak server memory to clients","impact":"medium","summary":"A use-after-free bug in MongoDB's classic query engine plan cache lets a diagnostic command read freed heap memory. An authenticated client may receive sensitive server process memory contents, and under some heap reuse conditions the server can crash.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated client reads server process memory; possible crash","analyst_note":"Check the MongoDB SERVER advisory and affected/fixed version ranges at https://nvd.nist.gov/vuln/detail/CVE-2026-120811 to fill how_to_check and fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Affects MongoDB servers using the classic query engine plan cache, reached by a client that already has valid credentials. Exposure depends on the query conditions and diagnostic commands in use, which the sources do not detail. Deployments that run only managed MongoDB services where the vendor patches the server are not the team's to fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4595,"output_tokens":494,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120811':16A,19A '-2026':15A,18A 'also':141C 'authent':49B,132C 'bug':31B 'cach':3A,39B,84C,102C 'caus':142C 'certain':86C,135C 'classic':35B,80C 'client':13A,50B,133C 'command':43B,97C,114C 'condit':63B,88C,138C 'content':57B,129C 'crash':67B,146C 'cve':14A,17A 'data':93C 'databas':20B 'diagnost':42B,113C 'earlier':96C 'engin':37B,82C 'exist':74C 'free':7A,30B,72C 'freed':45B,110C,120C 'heap':46B,61B,121C,136C 'host':25B 'issu':73C 'leak':9A 'let':40B 'may':51B,140C 'memori':11A,47B,56B,108C,122C,128C 'mongodb':1A,21B,33B,77C 'origin':107C 'packag':22B 'plan':2A,38B,83C,103C 'potenti':123C 'process':55B,127C 'queri':36B,81C,87C 'read':44B,119C 'receiv':52B 'refer':91C 'retain':100C 'return':124C 'reus':62B,137C 'self':24B 'self-host':23B 'sensit':53B,125C 'serial':115C 'server':10A,54B,65B,78C,126C,144C 'statist':104C,117C 'subsequ':112C 'unown':90C 'use':5A,28B,70C 'use-after-fre':4A,27B,69C","nicknames":[],"mitigations":[],"who_affected":"Affects MongoDB servers using the classic query engine plan cache, reached by a client that already has valid credentials. Exposure depends on the query conditions and diagnostic commands in use, which the sources do not detail. Deployments that run only managed MongoDB services where the vendor patches the server are not the team's to fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","mongodb","package","selfhosted"],"campaign_type":null,"search_a":"'-120811':16A,19A '-2026':15A,18A 'cach':3A 'client':13A 'cve':14A,17A 'free':7A 'leak':9A 'memori':11A 'mongodb':1A 'plan':2A 'server':10A 'use':5A 'use-after-fre':4A","search_b":"'authent':49B 'bug':31B 'cach':39B 'classic':35B 'client':50B 'command':43B 'condit':63B 'content':57B 'crash':67B 'databas':20B 'diagnost':42B 'engin':37B 'free':30B 'freed':45B 'heap':46B,61B 'host':25B 'let':40B 'may':51B 'memori':47B,56B 'mongodb':21B,33B 'packag':22B 'plan':38B 'process':55B 'queri':36B 'read':44B 'receiv':52B 'reus':62B 'self':24B 'self-host':23B 'sensit':53B 'server':54B,65B 'use':28B 'use-after-fre':27B","search_c":"'also':141C 'authent':132C 'cach':84C,102C 'caus':142C 'certain':86C,135C 'classic':80C 'client':133C 'command':97C,114C 'condit':88C,138C 'content':129C 'crash':146C 'data':93C 'diagnost':113C 'earlier':96C 'engin':82C 'exist':74C 'free':72C 'freed':110C,120C 'heap':121C,136C 'issu':73C 'may':140C 'memori':108C,122C,128C 'mongodb':77C 'origin':107C 'plan':83C,103C 'potenti':123C 'process':127C 'queri':81C,87C 'read':119C 'refer':91C 'retain':100C 'return':124C 'reus':137C 'sensit':125C 'serial':115C 'server':78C,126C,144C 'statist':104C,117C 'subsequ':112C 'unown':90C 'use':70C 'use-after-fre':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120811","severity":null,"published_at":"2026-11-10T20:18:51+00:00","modified_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}