MONGODB SERVER · CVE-2026-120817 · Runtime
FIX → 9.0.7 · 8.3.16 · 7.0.48 +1 ✓ verified
A race condition in MongoDB Server's schema validation occurs when concurrent writes are checked against a collection validator that uses geospatial query operators. An authenticated user with write privileges can trigger it, causing the server to terminate unexpectedly.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-managed MongoDB Server 7.0, 8.0, 8.3 and 9.0 deployments before the fixed versions, where a collection validator uses geospatial query operators and receives concurrent writes. An attacker needs an authenticated account with write privileges; the effect is a server crash (denial of service). Teams with no geospatial validators, or whose users cannot write, can deprioritise; whether Atlas is patched is not stated in the sources I read.
Not affected if auth-required, no-geospatial-validators, no-untrusted-writers
Who cares authenticated, database, denial-of-service, mongodb, self-hosted
7.0.48, 8.0.37, 8.3.16 or 9.0.7 on those branches are in the reported rangePosts are quoted with a link to the original. They are data to us, never instructions.
A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 9.0.7 · 8.3.16 · 7.0.48 +1
Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later on your branch).