{"id":"CVE-2026-120814","kind":"vulnerability","aliases":["CVE-2026-120814"],"related":[],"title":"MongoDB Server: users with write access to the config database can write to any database in sharded clusters","description":"An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data across the cluster.","summary":"A user with certain shard-level administrative privileges can make MongoDB reprocess persisted internal coordination state with elevated internal authority. This can let them change cluster-wide security settings and access or modify data across the cluster.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["8.0.37","8.3.16","9.0.7"],"affected":">= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["databases","mongodb","self-hosted","sharded-clusters","vendor"],"not_affected_if":["managed-hosting","no-shard-admin-users","unsharded-deployment"],"how_to_check":"- Run mongod --version (or db.version()) on each cluster member; affected: 8.0.0 to before 8.0.37, 8.3.0 to before 8.3.16, 9.0.0 to before 9.0.7.\n- On sharded clusters, list users/roles with write permission on the config database or shard-level admin roles (db.getSiblingDB('admin').system.users.find()). Also check 7.0 deployments: MongoDB requested a 7.0 backport but did not list 7.0 in the affected data.","fix":"Upgrade MongoDB Server to 8.0.37, 8.3.16 or 9.0.7 (per SERVER-133600). 7.0 is not listed as affected or fixed by MongoDB; unknown.","status":"open","published_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:47:48+00:00","updated_at":"2026-11-10T21:01:56+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-10T20:47:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: sharding flaw lets shard admins act beyond their scope","impact":"high","summary":"A user with certain shard-level administrative privileges can make MongoDB reprocess persisted internal coordination state with elevated internal authority. This can let them change cluster-wide security settings and access or modify data across the cluster.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["mongodb","self-hosted","sharded-clusters","databases"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker changes cluster security configuration and reads or modifies cluster data","analyst_note":"Find the affected and fixed MongoDB Server versions for CVE-2026-120814 in the NVD entry or MongoDB's advisory.","how_to_check":"- Check the MongoDB Server version with `mongod --version` on each cluster member and compare against the fixed versions in the advisory.\n- Identify which users hold shard-level administrative roles on sharded clusters.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unsharded-deployment","no-shard-admin-users","managed-hosting"],"who_is_affected":"Only sharded MongoDB clusters are described, and the attacker needs an authenticated session directly against a cluster member and certain shard-level admin privileges. Teams running standalone or unsharded deployments, or who restrict shard admin roles tightly, are less exposed. The sources do not list affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4621,"output_tokens":570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed MongoDB Server versions for CVE-2026-120814 in the NVD entry or MongoDB's advisory.","search":"'-120814':21A,24A '-2026':20A,23A 'access':6A,68B,158C 'across':72B,164C 'administr':43B,96C 'allow':88C 'authent':146C 'author':56B,110C,130C 'beyond':126C 'carri':124C 'caus':99C 'certain':39B,92C 'chang':61B,133C 'cluster':18A,34B,63B,74B,136C,151C,166C 'cluster-wid':62B,135C 'config':9A 'configur':139C 'coordin':51B,102C 'cve':19A,22A 'data':71B,163C 'databas':10A,15A,27B 'direct':148C 'elev':54B,108C 'hold':91C 'host':31B 'improp':76C 'includ':132C 'intern':50B,55B,101C,109C 'issu':79C,143C 'let':59B 'level':42B,95C 'make':46B 'manag':78C 'may':87C,122C 'member':152C 'modif':161C 'modifi':70B 'mongodb':1A,25A,28B,47B,85C 'oper':121C 'persist':49B,100C 'privileg':44B,77C,97C 'rather':116C 're':119C 're-valid':118C 'reprocess':48B,106C 'requir':144C 'result':155C 'scope':131C 'secur':65B,138C 'self':30B 'self-host':29B 'server':2A,26A,86C 'session':147C 'set':66B 'shard':17A,33B,41B,82C,94C 'shard-level':40B,93C 'sharded-clust':32B 'state':52B,103C,113C 'subsystem':83C 'success':140C 'trigger':141C 'trust':115C 'unauthor':157C 'user':3A,37B,90C,128C 'valid':120C 'vendor':35B 'wide':64B,137C 'write':5A,12A","nicknames":[],"mitigations":[],"who_affected":"Self-managed sharded MongoDB Server clusters on 8.0, 8.3 or 9.0 below the fixed versions. An attacker needs an authenticated session directly on a cluster member with high privileges (write access to the config database / shard-level admin), and can then act beyond that scope, including changing security settings and reading or writing data in any database. Unsharded deployments and setups with no such users can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:01:56Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-133600","run_id":2738},"products":{"at":"2026-11-10T21:01:56Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-133600","run_id":2738},"who_affected":{"at":"2026-11-10T21:01:56Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-133600","run_id":2738}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["databases","high","mongodb","selfhosted","shardedclusters","vendor"],"campaign_type":null,"search_a":"'-120814':21A,24A '-2026':20A,23A 'access':6A 'cluster':18A 'config':9A 'cve':19A,22A 'databas':10A,15A 'mongodb':1A,25A 'server':2A,26A 'shard':17A 'user':3A 'write':5A,12A","search_b":"'access':68B 'across':72B 'administr':43B 'author':56B 'certain':39B 'chang':61B 'cluster':34B,63B,74B 'cluster-wid':62B 'coordin':51B 'data':71B 'databas':27B 'elev':54B 'host':31B 'intern':50B,55B 'let':59B 'level':42B 'make':46B 'modifi':70B 'mongodb':28B,47B 'persist':49B 'privileg':44B 'reprocess':48B 'secur':65B 'self':30B 'self-host':29B 'set':66B 'shard':33B,41B 'shard-level':40B 'sharded-clust':32B 'state':52B 'user':37B 'vendor':35B 'wide':64B","search_c":"'access':158C 'across':164C 'administr':96C 'allow':88C 'authent':146C 'author':110C,130C 'beyond':126C 'carri':124C 'caus':99C 'certain':92C 'chang':133C 'cluster':136C,151C,166C 'cluster-wid':135C 'configur':139C 'coordin':102C 'data':163C 'direct':148C 'elev':108C 'hold':91C 'improp':76C 'includ':132C 'intern':101C,109C 'issu':79C,143C 'level':95C 'manag':78C 'may':87C,122C 'member':152C 'modif':161C 'mongodb':85C 'oper':121C 'persist':100C 'privileg':77C,97C 'rather':116C 're':119C 're-valid':118C 'reprocess':106C 'requir':144C 'result':155C 'scope':131C 'secur':138C 'server':86C 'session':147C 'shard':82C,94C 'shard-level':93C 'state':103C,113C 'subsystem':83C 'success':140C 'trigger':141C 'trust':115C 'unauthor':157C 'user':90C,128C 'valid':120C 'wide':137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120814","severity":null,"published_at":"2026-11-10T20:18:52+00:00","modified_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120814:2738","url":"https://jira.mongodb.org/browse/SERVER-133600","severity":null,"published_at":"2026-11-10T21:01:56+00:00","modified_at":"2026-11-10T21:01:56+00:00","first_seen_at":"2026-11-10T21:01:56+00:00","fetched_at":"2026-11-10T21:01:56+00:00","note":"NVD/MongoDB CNA record and MongoDB Jira SERVER-133600 (fix versions 8.0.37, 8.3.16, 9.0.7). 7.0 backport was requested but is not listed as fixed or affected; unknown.","cites":["https://jira.mongodb.org/browse/SERVER-133600","https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120814"]}],"documents":[{"id":118474,"url":"https://jira.mongodb.org/browse/SERVER-133600","title":"SERVER-133600: Users with write permissions to config database can write to any database through MultiUpdateCoordinatorDocument","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118475,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120814","title":"NVD record CVE-2026-120814 (MongoDB CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}