---
id: "CVE-2026-120828"
page: "https://infrastack.ai/live/CVE-2026-120828"
kind: "vulnerability"
aliases: ["CVE-2026-120828"]
title: "MongoDB Server: unauthenticated readConcern requests can leak wait records and exhaust memory"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "MongoDB Server", "fixed": ["9.0.7", "8.3.16", "8.0.37", "7.0.48", "6.0.30", "5.0.35", "4.4.32"], "affected": ">= 9.0.0, < 9.0.7; >= 8.3.0, < 8.3.16; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.48; >= 6.0.0, < 6.0.30; >= 5.0.0, < 5.0.35; >= 4.4.0, < 4.4.32", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database", "denial-of-service", "infrastructure", "mongodb", "replica-set", "self-hosted"]
not_affected_if: ["network-restricted", "patched-version", "unknown"]
published_at: "2026-11-10T21:19:02+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:50:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120828", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120828", "first_seen_at": "2026-11-10T21:50:21+00:00", "cites": ["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120828", "https://jira.mongodb.org/browse/SERVER-138119"]}]
exploit_sources: []
---

# MongoDB Server: unauthenticated readConcern requests can leak wait records and exhaust memory

Link for people: https://infrastack.ai/live/CVE-2026-120828 (this .md is for agents)

A MongoDB Server replica-set node does not limit or free internal wait records created when a client sends a read option naming a point in time the node never reaches. An unauthenticated network attacker can make them accumulate until the server runs out of memory. The fix, per the linked MongoDB ticket, limits readConcern afterOpTime to system users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 9.0.0, < 9.0.7; >= 8.3.0, < 8.3.16; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.48; >= 6.0.0, < 6.0.30; >= 5.0.0, < 5.0.35; >= 4.4.0, < 4.4.32 fixed 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, 4.4.32

## How to check

Run db.version() or mongod --version on every replica-set member and compare with the fixed versions; any 4.4.0-4.4.31, 5.0.0-5.0.34, 6.0.0-6.0.29, 7.0.0-7.0.47, 8.0.0-8.0.36, 8.3.0-8.3.15 or 9.0.0-9.0.6 is in range. Also check whether mongod port (27017) is reachable from untrusted networks.

## Fix

Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 (or later in your line). The fix (SERVER-138119) restricts readConcern afterOpTime to system users.

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120828
- 2026-11-10T21:50:21+00:00 analyst https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120828 — Versions from the MongoDB CNA record in NVD; fix versions and afterOpTime change from MongoDB's SERVER-138119 (title only, no description; link to the CVE mechanism is inferred). No PoC or exploitation seen; no social search done.

## Documents

- [describes] NVD record CVE-2026-120828 (CNA: MongoDB) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120828
- [fix] SERVER-138119 Allow only system users to use readConcern afterOpTime https://jira.mongodb.org/browse/SERVER-138119

## From the sources

A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_