---
id: "CVE-2026-120824"
page: "https://infrastack.ai/live/CVE-2026-120824"
kind: "vulnerability"
aliases: ["CVE-2026-120824"]
title: "MongoDB Server: authenticated user with insert rights on a time-series collection can crash mongod or possibly run code via a crafted raw bucket"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB Server", "fixed": ["9.0.7", "8.3.16", "8.0.37", "7.0.48"], "affected": ">= 8.0.28, < 8.0.37 || >= 8.3.3, < 8.3.16 || >= 9.0.0, < 9.0.7 || >= 7.0.0, < 7.0.48 (7.0 per CVE record only; Jira says not affected via the strict-validation path)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "mongodb", "runtime", "self-hosted", "time-series"]
not_affected_if: ["default-config", "no-direct-bucket-writes", "no-time-series", "no-time-series-collections"]
published_at: "2026-11-10T21:19:02+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:51:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120824", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-136505", "first_seen_at": "2026-11-10T21:51:30+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-136505", "https://nvd.nist.gov/vuln/detail/CVE-2026-120824", "https://hol.org/guard/security/cves/CVE-2026-120824-post-authentication-use-after-free-in-mongodb"]}]
exploit_sources: []
---

# MongoDB Server: authenticated user with insert rights on a time-series collection can crash mongod or possibly run code via a crafted raw bucket

Link for people: https://infrastack.ai/live/CVE-2026-120824 (this .md is for agents)

A use-after-free and double-free in MongoDB's strict time-series bucket validator (SERVER-136505). One raw insert (rawData: true) of a crafted uncompressed bucket, where a field is an object in some measurements and an array in others, corrupts the heap before the write is rejected. MongoDB confirms a server crash in a single request. An external reporter demonstrates command execution as the mongod OS user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 8.0.28, < 8.0.37 || >= 8.3.3, < 8.3.16 || >= 9.0.0, < 9.0.7 || >= 7.0.0, < 7.0.48 (7.0 per CVE record only; Jira says not affected via the strict-validation path) fixed 9.0.7, 8.3.16, 8.0.37, 7.0.48

## How to check

Run db.version() or mongod --version. You are exposed if it is 8.0.28-8.0.36, 8.2.12 or later without a fix on that line, 8.3.3-8.3.15, or 9.0.0-9.0.6 and you have time-series collections where some users have insert privileges. Also check 7.0 below 7.0.48: the CVE record lists it, but Jira says 7.0 is not affected through the strict-validation path and the catalog-reopen path is still under investigation. Review which roles can insert into time-series collections (db.getRoles / db.getUsers).

## Fix

Upgrade to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (fix versions in SERVER-136505).

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120824
- 2026-11-10T21:51:30+00:00 analyst https://jira.mongodb.org/browse/SERVER-136505 — MongoDB's Jira SERVER-136505 (maintainer page) gives cause, reachability and fix versions; the CVE-record mirror gives the ranges. No public exploit link, no exploitation reported. Jira says 7.0 is not affected via the strict-validation path while the CVE record lists 7.0 < 7.0.48, so I listed 7.0 as unconfirmed.

## Documents

- [advisory] SERVER-136505: UAF in strict time-series bucket validation (MongoDB) https://jira.mongodb.org/browse/SERVER-136505
- [describes] NVD CVE-2026-120824 https://nvd.nist.gov/vuln/detail/CVE-2026-120824
- [mentions] HOL Guard: CVE-2026-120824 (mirror of CVE record, version ranges) https://hol.org/guard/security/cves/CVE-2026-120824-post-authentication-use-after-free-in-mongodb

## From the sources

A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_