---
id: "CVE-2026-120814"
page: "https://infrastack.ai/live/CVE-2026-120814"
kind: "vulnerability"
aliases: ["CVE-2026-120814"]
title: "MongoDB Server: users with write access to the config database can write to any database in sharded clusters"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "MongoDB Server", "fixed": ["8.0.37", "8.3.16", "9.0.7"], "affected": ">= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["databases", "mongodb", "self-hosted", "sharded-clusters", "vendor"]
not_affected_if: ["managed-hosting", "no-shard-admin-users", "unsharded-deployment"]
published_at: "2026-11-10T20:18:52+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T21:01:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120814", "first_seen_at": "2026-11-10T20:46:02+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-133600", "first_seen_at": "2026-11-10T21:01:56+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-133600", "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120814"]}]
exploit_sources: []
---

# MongoDB Server: users with write access to the config database can write to any database in sharded clusters

Link for people: https://infrastack.ai/live/CVE-2026-120814 (this .md is for agents)

A user with certain shard-level administrative privileges can make MongoDB reprocess persisted internal coordination state with elevated internal authority. This can let them change cluster-wide security settings and access or modify data across the cluster.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7 fixed 8.0.37, 8.3.16, 9.0.7

## How to check

- Run mongod --version (or db.version()) on each cluster member; affected: 8.0.0 to before 8.0.37, 8.3.0 to before 8.3.16, 9.0.0 to before 9.0.7.
- On sharded clusters, list users/roles with write permission on the config database or shard-level admin roles (db.getSiblingDB('admin').system.users.find()). Also check 7.0 deployments: MongoDB requested a 7.0 backport but did not list 7.0 in the affected data.

## Fix

Upgrade MongoDB Server to 8.0.37, 8.3.16 or 9.0.7 (per SERVER-133600). 7.0 is not listed as affected or fixed by MongoDB; unknown.

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120814
- 2026-11-10T21:01:56+00:00 analyst https://jira.mongodb.org/browse/SERVER-133600 — NVD/MongoDB CNA record and MongoDB Jira SERVER-133600 (fix versions 8.0.37, 8.3.16, 9.0.7). 7.0 backport was requested but is not listed as fixed or affected; unknown.

## Documents

- [advisory] SERVER-133600: Users with write permissions to config database can write to any database through MultiUpdateCoordinatorDocument https://jira.mongodb.org/browse/SERVER-133600
- [describes] NVD record CVE-2026-120814 (MongoDB CNA data) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120814

## From the sources

An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data across the cluster.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_