CVE-2026-120815 · Vendor
NO FIX YET
MongoDB Server has an incorrect authorization check that can let an unauthenticated party with local host access obtain administrative privileges on a server with authorization enabled. An attacker could then read stored data and credentials, modify data, or take the server offline.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted MongoDB Server with authorization enabled, where an untrusted person or process can run code on the same host (shared servers, containers sharing a host, compromised app on the DB box). The CNA rates it local-access, no privileges needed (CVSS 4.0 8.6). Affected versions are not yet published. Managed hosting such as Atlas is likely patched by the vendor, but this is not confirmed.
Not affected if authorization-disabled, managed-hosting
Who cares databases, mongodb, self-hosted
Unknown from the sources.
An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.