{"id":"CVE-2026-120817","kind":"vulnerability","aliases":["CVE-2026-120817"],"related":[],"title":"MongoDB Server: race in schema validation can crash the server","description":"A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.","summary":"A race condition in MongoDB Server's schema validation occurs when concurrent writes are checked against a collection validator that uses geospatial query operators. An authenticated user with write privileges can trigger it, causing the server to terminate unexpectedly.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["7.0.48","8.0.37","8.3.16","9.0.7"],"affected":">= 7.0.0, < 7.0.48 || >= 8.0.0, < 8.0.37 || >= 8.3.0, < 8.3.16 || >= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["authenticated","database","denial-of-service","mongodb","runtime","self-hosted"],"not_affected_if":["auth-required","no-geospatial-validators","no-untrusted-writers"],"how_to_check":"Run db.version() or mongod --version; versions below 7.0.48, 8.0.37, 8.3.16 or 9.0.7 on those branches are in the reported range. Then list collections whose validator uses geospatial operators: db.getCollectionInfos() and inspect options.validator for $geoWithin, $geoIntersects, $near. No such validator means the described trigger does not apply.","fix":"Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later on your branch).","status":"open","published_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:48:26+00:00","updated_at":"2026-11-10T21:52:44+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T21:48:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: race in schema validation can crash the server","impact":"low","summary":"A race condition in MongoDB Server's schema validation occurs when concurrent writes are checked against a collection validator that uses geospatial query operators. An authenticated user with write privileges can trigger it, causing the server to terminate unexpectedly.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server process terminates unexpectedly, causing database downtime.","analyst_note":"Find the affected and fixed MongoDB Server versions and the NVD/MongoDB advisory for CVE-2026-120817; sources list no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"MongoDB Server","needs_analyst":true,"not_affected_if":["no-geospatial-validators","no-untrusted-writers"],"who_is_affected":"Deployments running MongoDB Server where collections use validators with geospatial query operators and users have write access. The sources do not state which versions are affected or which configurations are required beyond that.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4533,"output_tokens":473,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed MongoDB Server versions and the NVD/MongoDB advisory for CVE-2026-120817; sources list no product ranges.","search":"'-120817':13A,16A '-2026':12A,15A 'authent':19B,55B,103C 'caus':63B,100C 'check':44B,86C 'collect':47B,89C 'compon':76C 'concurr':41B,83C 'condit':32B,71C,97C 'crash':8A 'cve':11A,14A 'databas':20B 'denial':22B 'denial-of-servic':21B 'geospati':51B,93C 'host':29B 'may':109C 'mongodb':1A,17A,25B,34B,78C 'occur':39B,81C 'oper':53B,95C 'privileg':59B,107C 'queri':52B,94C 'race':3A,31B,70C 'result':110C 'runtim':26B 'schema':5A,37B,74C 'self':28B 'self-host':27B 'server':2A,10A,18A,35B,65B,79C,113C 'servic':24B 'termin':67B,114C 'trigger':61B 'unexpect':68B,115C 'use':50B,92C 'user':56B,104C 'valid':6A,38B,48B,75C,90C 'write':42B,58B,84C,106C","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB Server 7.0, 8.0, 8.3 and 9.0 deployments before the fixed versions, where a collection validator uses geospatial query operators and receives concurrent writes. An attacker needs an authenticated account with write privileges; the effect is a server crash (denial of service). Teams with no geospatial validators, or whose users cannot write, can deprioritise; whether Atlas is patched is not stated in the sources I read.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:52:44Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-135655","run_id":2874}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["authenticated","database","denialofservice","high","mongodb","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120817':13A,16A '-2026':12A,15A 'crash':8A 'cve':11A,14A 'mongodb':1A,17A 'race':3A 'schema':5A 'server':2A,10A,18A 'valid':6A","search_b":"'authent':19B,55B 'caus':63B 'check':44B 'collect':47B 'concurr':41B 'condit':32B 'databas':20B 'denial':22B 'denial-of-servic':21B 'geospati':51B 'host':29B 'mongodb':25B,34B 'occur':39B 'oper':53B 'privileg':59B 'queri':52B 'race':31B 'runtim':26B 'schema':37B 'self':28B 'self-host':27B 'server':35B,65B 'servic':24B 'termin':67B 'trigger':61B 'unexpect':68B 'use':50B 'user':56B 'valid':38B,48B 'write':42B,58B","search_c":"'authent':103C 'caus':100C 'check':86C 'collect':89C 'compon':76C 'concurr':83C 'condit':71C,97C 'geospati':93C 'may':109C 'mongodb':78C 'occur':81C 'oper':95C 'privileg':107C 'queri':94C 'race':70C 'result':110C 'schema':74C 'server':79C,113C 'termin':114C 'unexpect':115C 'use':92C 'user':104C 'valid':75C,90C 'write':84C,106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120817","severity":null,"published_at":"2026-11-10T21:19:00+00:00","modified_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120817:2874","url":"https://jira.mongodb.org/browse/SERVER-135655","severity":null,"published_at":"2026-11-10T21:52:44+00:00","modified_at":"2026-11-10T21:52:44+00:00","first_seen_at":"2026-11-10T21:52:44+00:00","fetched_at":"2026-11-10T21:52:44+00:00","note":"Fix versions confirmed on MongoDB Jira SERVER-135655 (vendor, fixed Nov 10 2026: S2 classes' shared lazily-initialized state causes data races/crash). Lower bounds (x.0.0) come only from a CVE-list mirror (HOL); Jira lists no Affects version, so older branches (<7.0) are unconfirmed. NVD page returned empty; no MongoDB alerts entry. Not the same as CVE-2026-18700 (UAF in geospatial validation). No exploitation or PoC found; social search not done.","cites":["https://jira.mongodb.org/browse/SERVER-135655","https://hol.org/guard/security/cves/CVE-2026-120817-post-authentication-race-condition-in-mongodb"]}],"documents":[{"id":119308,"url":"https://jira.mongodb.org/browse/SERVER-135655","title":"SERVER-135655: Shared lazily-initialized state in S2 classes allow data races","kind":"issue","source":"analyst","publisher":null,"text":"Bug, Resolved Fixed Nov 10 2026. Fix Version/s: 8.3.16, 9.0.7, 8.0.37, 7.0.48. Affects Version/s: None listed. S2EdgeIndex and S2Loop have mutable state changed by const methods; map/multimap members (S2Loop::vertext_to_index_, S2EdgeIndex::mapping_) can crash the server when accessed concurrently. Backport requested v9.0, v8.3, v8.0, v7.0.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119310,"url":"https://hol.org/guard/security/cves/CVE-2026-120817-post-authentication-race-condition-in-mongodb","title":"HOL Guard record CVE-2026-120817 (CVE list mirror)","kind":"other","source":"analyst","publisher":null,"text":"CVSS 7.1 High, CWE-362. Description: race condition in schema validation component of MongoDB Server when concurrent writes are checked against a collection validator that uses geospatial query operators; authenticated user with write privileges; server may terminate. Mapped ranges: >=9.0.0 <9.0.7, >=8.3.0 <8.3.16, >=8.0.0 <8.0.37, >=7.0.0 <7.0.48. Reference: SERVER-135655.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}