{"id":"CVE-2026-120824","kind":"vulnerability","aliases":["CVE-2026-120824"],"related":[],"title":"MongoDB Server: authenticated user with insert rights on a time-series collection can crash mongod or possibly run code via a crafted raw bucket","description":"A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.","summary":"A use-after-free and double-free in MongoDB's strict time-series bucket validator (SERVER-136505). One raw insert (rawData: true) of a crafted uncompressed bucket, where a field is an object in some measurements and an array in others, corrupts the heap before the write is rejected. MongoDB confirms a server crash in a single request. An external reporter demonstrates command execution as the mongod OS user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["9.0.7","8.3.16","8.0.37","7.0.48"],"affected":">= 8.0.28, < 8.0.37 || >= 8.3.3, < 8.3.16 || >= 9.0.0, < 9.0.7 || >= 7.0.0, < 7.0.48 (7.0 per CVE record only; Jira says not affected via the strict-validation path)","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","mongodb","runtime","self-hosted","time-series"],"not_affected_if":["default-config","no-direct-bucket-writes","no-time-series","no-time-series-collections"],"how_to_check":"Run db.version() or mongod --version. You are exposed if it is 8.0.28-8.0.36, 8.2.12 or later without a fix on that line, 8.3.3-8.3.15, or 9.0.0-9.0.6 and you have time-series collections where some users have insert privileges. Also check 7.0 below 7.0.48: the CVE record lists it, but Jira says 7.0 is not affected through the strict-validation path and the catalog-reopen path is still under investigation. Review which roles can insert into time-series collections (db.getRoles / db.getUsers).","fix":"Upgrade to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (fix versions in SERVER-136505).","status":"open","published_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:47:41+00:00","updated_at":"2026-11-10T21:51:30+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T21:47:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: time-series write bug lets an authenticated user run code","impact":"high","summary":"A use-after-free in MongoDB Server's time-series collection code runs when the server validates a bucket document during a write. An authenticated user who can write bucket documents directly can crash the server or, under certain conditions, run arbitrary code in the server process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","time-series"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"server crashes, or under conditions code runs in server process","analyst_note":"Find affected and fixed MongoDB Server versions and the time-series configuration needed, from the NVD entry or MongoDB's security advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-time-series-collections","no-direct-bucket-writes"],"who_is_affected":"Deployments running MongoDB Server with time-series collections where users can write directly to bucket documents are the exposed case. The sources do not name affected versions or the exact configuration, so unknown. Deployments without time-series collections or without such write privileges are likely not affected, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4557,"output_tokens":486,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed MongoDB Server versions and the time-series configuration needed, from the NVD entry or MongoDB's security advisory.","search":"'-120824':28A,31A '-136505':62B '-2026':27A,30A 'arbitrari':173C 'array':84B 'authent':3A,34B,152C 'bucket':25A,59B,72B,140C,158C 'caus':149C 'certain':171C 'code':20A,174C 'collect':13A,125C 'command':108B 'compon':126C 'condit':146C,172C 'confirm':96B 'context':178C 'corrupt':87B 'craft':23A,70B 'crash':15A,99B 'cve':26A,29A 'demonstr':107B 'direct':160C 'document':141C,159C 'doubl':50B 'double-fre':49B 'execut':109B,175C 'extern':105B 'field':75B 'free':47B,51B,119C 'heap':89B 'host':39B 'insert':6A,65B 'may':162C 'measur':81B 'mongod':16A,112B 'mongodb':1A,32A,35B,53B,95B,128C 'object':78B 'occur':131C 'one':63B 'os':113B 'other':86B 'possibl':18A 'privileg':155C 'process':182C 'raw':24A,64B 'rawdata':66B 'reject':94B 'report':106B 'request':103B 'result':163C 'right':7A 'run':19A 'runtim':36B 'self':38B 'self-host':37B 'seri':12A,42B,58B,124C,139C 'server':2A,33A,61B,98B,129C,134C,166C,181C 'singl':102B 'strict':55B 'termin':167C 'time':11A,41B,57B,123C,138C 'time-seri':10A,40B,56B,122C,137C 'true':67B 'uncompress':71B 'unexpect':168C 'use':45B,117C 'use-after-fre':44B,116C 'user':4A,114B,153C 'valid':60B,135C 'via':21A 'write':92B,144C,157C","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB Server deployments that use time-series collections and give any user insert privileges on them. The attacker must be authenticated. Skip it if you have no time-series collections or only trusted services can write to them. Managed services (for example Atlas) were not checked here.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:51:30Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-136505","run_id":2870}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["authenticated","high","mongodb","runtime","selfhosted","timeseries"],"campaign_type":null,"search_a":"'-120824':28A,31A '-2026':27A,30A 'authent':3A 'bucket':25A 'code':20A 'collect':13A 'craft':23A 'crash':15A 'cve':26A,29A 'insert':6A 'mongod':16A 'mongodb':1A,32A 'possibl':18A 'raw':24A 'right':7A 'run':19A 'seri':12A 'server':2A,33A 'time':11A 'time-seri':10A 'user':4A 'via':21A","search_b":"'-136505':62B 'array':84B 'authent':34B 'bucket':59B,72B 'command':108B 'confirm':96B 'corrupt':87B 'craft':70B 'crash':99B 'demonstr':107B 'doubl':50B 'double-fre':49B 'execut':109B 'extern':105B 'field':75B 'free':47B,51B 'heap':89B 'host':39B 'insert':65B 'measur':81B 'mongod':112B 'mongodb':35B,53B,95B 'object':78B 'one':63B 'os':113B 'other':86B 'raw':64B 'rawdata':66B 'reject':94B 'report':106B 'request':103B 'runtim':36B 'self':38B 'self-host':37B 'seri':42B,58B 'server':61B,98B 'singl':102B 'strict':55B 'time':41B,57B 'time-seri':40B,56B 'true':67B 'uncompress':71B 'use':45B 'use-after-fre':44B 'user':114B 'valid':60B 'write':92B","search_c":"'arbitrari':173C 'authent':152C 'bucket':140C,158C 'caus':149C 'certain':171C 'code':174C 'collect':125C 'compon':126C 'condit':146C,172C 'context':178C 'direct':160C 'document':141C,159C 'execut':175C 'free':119C 'may':162C 'mongodb':128C 'occur':131C 'privileg':155C 'process':182C 'result':163C 'seri':124C,139C 'server':129C,134C,166C,181C 'termin':167C 'time':123C,138C 'time-seri':122C,137C 'unexpect':168C 'use':117C 'use-after-fre':116C 'user':153C 'valid':135C 'write':144C,157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120824","severity":null,"published_at":"2026-11-10T21:19:02+00:00","modified_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120824:2870","url":"https://jira.mongodb.org/browse/SERVER-136505","severity":null,"published_at":"2026-11-10T21:51:30+00:00","modified_at":"2026-11-10T21:51:30+00:00","first_seen_at":"2026-11-10T21:51:30+00:00","fetched_at":"2026-11-10T21:51:30+00:00","note":"MongoDB's Jira SERVER-136505 (maintainer page) gives cause, reachability and fix versions; the CVE-record mirror gives the ranges. No public exploit link, no exploitation reported. Jira says 7.0 is not affected via the strict-validation path while the CVE record lists 7.0 < 7.0.48, so I listed 7.0 as unconfirmed.","cites":["https://jira.mongodb.org/browse/SERVER-136505","https://nvd.nist.gov/vuln/detail/CVE-2026-120824","https://hol.org/guard/security/cves/CVE-2026-120824-post-authentication-use-after-free-in-mongodb"]}],"documents":[{"id":119297,"url":"https://jira.mongodb.org/browse/SERVER-136505","title":"SERVER-136505: UAF in strict time-series bucket validation (MongoDB)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119296,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120824","title":"NVD CVE-2026-120824","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119295,"url":"https://hol.org/guard/security/cves/CVE-2026-120824-post-authentication-use-after-free-in-mongodb","title":"HOL Guard: CVE-2026-120824 (mirror of CVE record, version ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}