---
id: "CVE-2026-120817"
page: "https://infrastack.ai/live/CVE-2026-120817"
kind: "vulnerability"
aliases: ["CVE-2026-120817"]
title: "MongoDB Server: race in schema validation can crash the server"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB Server", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": ">= 7.0.0, < 7.0.48 || >= 8.0.0, < 8.0.37 || >= 8.3.0, < 8.3.16 || >= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["authenticated", "database", "denial-of-service", "mongodb", "runtime", "self-hosted"]
not_affected_if: ["auth-required", "no-geospatial-validators", "no-untrusted-writers"]
published_at: "2026-11-10T21:19:00+00:00"
first_seen_at: "2026-11-10T21:46:14+00:00"
updated_at: "2026-11-10T21:52:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120817", "first_seen_at": "2026-11-10T21:46:14+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-120817-post-authentication-race-condition-in-mongodb", "first_seen_at": "2026-11-10T21:52:44+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-120817-post-authentication-race-condition-in-mongodb", "https://jira.mongodb.org/browse/SERVER-135655"]}]
exploit_sources: []
---

# MongoDB Server: race in schema validation can crash the server

Link for people: https://infrastack.ai/live/CVE-2026-120817 (this .md is for agents)

A race condition in MongoDB Server's schema validation occurs when concurrent writes are checked against a collection validator that uses geospatial query operators. An authenticated user with write privileges can trigger it, causing the server to terminate unexpectedly.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 7.0.0, < 7.0.48 || >= 8.0.0, < 8.0.37 || >= 8.3.0, < 8.3.16 || >= 9.0.0, < 9.0.7 fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

Run db.version() or mongod --version; versions below 7.0.48, 8.0.37, 8.3.16 or 9.0.7 on those branches are in the reported range. Then list collections whose validator uses geospatial operators: db.getCollectionInfos() and inspect options.validator for $geoWithin, $geoIntersects, $near. No such validator means the described trigger does not apply.

## Fix

Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later on your branch).

## Timeline

- 2026-11-10T21:46:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120817
- 2026-11-10T21:52:44+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-120817-post-authentication-race-condition-in-mongodb — Fix versions confirmed on MongoDB Jira SERVER-135655 (vendor, fixed Nov 10 2026: S2 classes' shared lazily-initialized state causes data races/crash). Lower bounds (x.0.0) come only from a CVE-list mirror (HOL); Jira lists no Affects version, so older branches (<7.0) are unconfirmed. NVD page returned empty; no MongoDB alerts entry. Not the same as CVE-2026-18700 (UAF in geospatial validation). No exploitation or PoC found; social search not done.

## Documents

- [describes] HOL Guard record CVE-2026-120817 (CVE list mirror) https://hol.org/guard/security/cves/CVE-2026-120817-post-authentication-race-condition-in-mongodb
- [fix] SERVER-135655: Shared lazily-initialized state in S2 classes allow data races https://jira.mongodb.org/browse/SERVER-135655

## From the sources

A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_