MongoDB Server: Resource leak in Windows Kerberos authentication handler
Summary
MongoDB Server builds for Windows Enterprise with Kerberos (GSSAPI/SSPI) authentication fail to release a Windows credential handle during authentication handling. An unauthenticated remote attacker who can reach the MongoDB port can repeat Kerberos authentication requests until the process runs out of handles. After that, all subsequent Kerberos logins fail until the server is restarted. The impact is limited to availability; no data is exposed.
Affected
- MongoDB Server 9.0.0 before 9.0.7
- MongoDB Server 8.3.0 before 8.3.16
- MongoDB Server 8.0.0 before 8.0.37
- MongoDB Server 7.0.0 before 7.0.48
- Default configuration is not affected.
- Only Windows Enterprise builds with Kerberos/SSPI authentication are in scope.
Fixed in
- Upgrade to MongoDB Server 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later within the same branch).
- Versions 7.1, 6.0 and 5.0 are not listed as affected; their status has not been confirmed.
Workaround
- No vendor workaround known.
- Restrict network access to the MongoDB port to known application servers.
- Use Kerberos authentication only where it is required.
Exploitation
- No known exploitation in the wild at the time of writing.
- No public proof of concept known.
- Not listed in the CISA KEV catalog.
Our recommendation
- Check whether any MongoDB Server instances run on Windows Enterprise builds with Kerberos enabled.
- Plan the upgrade to the fixed versions and confirm the details in the MongoDB Jira ticket SERVER-130268.
- Confirm that the MongoDB port is not reachable from the internet and restrict it to required clients.
- Monitor for Kerberos logon failures and be prepared to restart the server if they occur.
- Recheck the NVD entry and the vendor ticket in a few days for updated information.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120804 www.cve.org
- MongoDB Jira ticket SERVER-130268 jira.mongodb.org
- Strix CVE-2026-120804 (secondary) www.strix.ai
- MongoDB Enterprise Kerberos (GSSAPI/SSPI) authentication documentation www.mongodb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:27.
Original description (NVD)
A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.