{"id":"CVE-2026-120828","kind":"vulnerability","aliases":["CVE-2026-120828"],"related":[],"title":"MongoDB Server: unauthenticated readConcern requests can leak wait records and exhaust memory","description":"A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.","summary":"A MongoDB Server replica-set node does not limit or free internal wait records created when a client sends a read option naming a point in time the node never reaches. An unauthenticated network attacker can make them accumulate until the server runs out of memory. The fix, per the linked MongoDB ticket, limits readConcern afterOpTime to system users.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["9.0.7","8.3.16","8.0.37","7.0.48","6.0.30","5.0.35","4.4.32"],"affected":">= 9.0.0, < 9.0.7; >= 8.3.0, < 8.3.16; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.48; >= 6.0.0, < 6.0.30; >= 5.0.0, < 5.0.35; >= 4.4.0, < 4.4.32","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","denial-of-service","infrastructure","mongodb","replica-set","self-hosted"],"not_affected_if":["network-restricted","patched-version","unknown"],"how_to_check":"Run db.version() or mongod --version on every replica-set member and compare with the fixed versions; any 4.4.0-4.4.31, 5.0.0-5.0.34, 6.0.0-6.0.29, 7.0.0-7.0.47, 8.0.0-8.0.36, 8.3.0-8.3.15 or 9.0.0-9.0.6 is in range. Also check whether mongod port (27017) is reachable from untrusted networks.","fix":"Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 (or later in your line). The fix (SERVER-138119) restricts readConcern afterOpTime to system users.","status":"open","published_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:47:45+00:00","updated_at":"2026-11-10T21:50:21+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T21:47:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB-style replica-set node leaks wait records, can exhaust memory","impact":"medium","summary":"A replica-set database server node keeps internal wait records created by a client read request naming a point in time it will never reach, and never frees them. An unauthenticated attacker on the network can make these records pile up until the server runs out of memory and stops responding.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["database","replica-set","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"server exhausts memory and becomes unavailable to clients","analyst_note":"Identify the affected database product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120828.","how_to_check":"- unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running a replica-set database node reachable from the network. The sources do not name the product or versions, so the exact exposure is unknown; a node only reachable from trusted hosts carries less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4539,"output_tokens":459,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected database product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120828.","search":"'-120828':15A,18A '-2026':14A,17A 'access':133C 'accumul':73B,142C 'afteroptim':90B 'attack':69B 'becom':161C 'bound':144C 'caus':138C 'client':52B,114C 'client-suppli':113C 'creat':49B,109C 'credenti':136C 'cve':13A,16A 'databas':21B,98C 'denial':23B 'denial-of-servic':22B 'end':150C 'exhaust':11A 'fix':82B 'free':45B 'handl':111C 'host':33B 'infrastructur':26B 'intern':46B,106C 'leak':7A 'limit':43B,88B,103C 'link':85B 'make':71B,153C 'may':152C 'memori':12A,80B,159C 'mongodb':1A,19A,27B,35B,86B 'name':57B,119C 'network':68B,132C 'never':64B,127C 'node':40B,63B,100C,125C 'option':56B,117C 'parti':130C 'per':83B 'persist':146C 'point':59B,121C 'reach':65B,128C 'read':55B,116C 'readconcern':4A,89B 'reclaim':105C 'record':9A,48B,108C,140C 'replica':29B,38B,96C 'replica-set':28B,37B,95C 'request':5A,149C 'run':77B,156C 'self':32B 'self-host':31B 'send':53B 'server':2A,20A,36B,76B,99C,155C 'servic':25B 'set':30B,39B,97C 'suppli':115C 'system':92B 'ticket':87B 'time':61B,123C 'unauthent':3A,67B 'unavail':162C 'user':93B 'wait':8A,47B,107C 'without':143C","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB Server replica-set nodes in versions 4.4 to 9.0 below the fixed releases whose port can be reached by untrusted clients, since no credentials are needed per the CVE record. Nodes reachable only from trusted hosts carry less risk. The sources do not say whether Atlas is affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:50:21Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-138119","run_id":2865}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["database","denialofservice","high","infrastructure","mongodb","replicaset","selfhosted"],"campaign_type":null,"search_a":"'-120828':15A,18A '-2026':14A,17A 'cve':13A,16A 'exhaust':11A 'leak':7A 'memori':12A 'mongodb':1A,19A 'readconcern':4A 'record':9A 'request':5A 'server':2A,20A 'unauthent':3A 'wait':8A","search_b":"'accumul':73B 'afteroptim':90B 'attack':69B 'client':52B 'creat':49B 'databas':21B 'denial':23B 'denial-of-servic':22B 'fix':82B 'free':45B 'host':33B 'infrastructur':26B 'intern':46B 'limit':43B,88B 'link':85B 'make':71B 'memori':80B 'mongodb':27B,35B,86B 'name':57B 'network':68B 'never':64B 'node':40B,63B 'option':56B 'per':83B 'point':59B 'reach':65B 'read':55B 'readconcern':89B 'record':48B 'replica':29B,38B 'replica-set':28B,37B 'run':77B 'self':32B 'self-host':31B 'send':53B 'server':36B,76B 'servic':25B 'set':30B,39B 'system':92B 'ticket':87B 'time':61B 'unauthent':67B 'user':93B 'wait':47B","search_c":"'access':133C 'accumul':142C 'becom':161C 'bound':144C 'caus':138C 'client':114C 'client-suppli':113C 'creat':109C 'credenti':136C 'databas':98C 'end':150C 'handl':111C 'intern':106C 'limit':103C 'make':153C 'may':152C 'memori':159C 'name':119C 'network':132C 'never':127C 'node':100C,125C 'option':117C 'parti':130C 'persist':146C 'point':121C 'reach':128C 'read':116C 'reclaim':105C 'record':108C,140C 'replica':96C 'replica-set':95C 'request':149C 'run':156C 'server':99C,155C 'set':97C 'suppli':115C 'time':123C 'unavail':162C 'wait':107C 'without':143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120828","severity":null,"published_at":"2026-11-10T21:19:02+00:00","modified_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120828:2865","url":"https://jira.mongodb.org/browse/SERVER-138119","severity":null,"published_at":"2026-11-10T21:50:21+00:00","modified_at":"2026-11-10T21:50:21+00:00","first_seen_at":"2026-11-10T21:50:21+00:00","fetched_at":"2026-11-10T21:50:21+00:00","note":"Versions from the MongoDB CNA record in NVD; fix versions and afterOpTime change from MongoDB's SERVER-138119 (title only, no description; link to the CVE mechanism is inferred). No PoC or exploitation seen; no social search done.","cites":["https://jira.mongodb.org/browse/SERVER-138119","https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120828"]}],"documents":[{"id":119287,"url":"https://jira.mongodb.org/browse/SERVER-138119","title":"SERVER-138119 Allow only system users to use readConcern afterOpTime","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119291,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120828","title":"NVD record CVE-2026-120828 (CNA: MongoDB)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}