MongoDB Server: Privilege escalation via fail-open X.509 cluster membership check
Summary
A flaw in the X.509 cluster-membership check of MongoDB Server can allow a holder of a valid cluster-member certificate to gain full internal system privileges. The check treats transient user lookup errors the same as a missing user, so authentication continues instead of being rejected. Exploitation requires a valid cluster-member certificate, a non-default X.509 cluster authentication configuration and specific timing during the user cache lookup.
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Default configuration is not affected.
- Versions 6.0 and older: Unknown.
Fixed in
- 9.0.7
- 8.3.16
- 8.0.37
- 7.0.48
Workaround
- No vendor workaround confirmed. Patching is the remedy.
- If patching is delayed: restrict network access to the cluster member ports, protect the private keys of member certificates and review which certificates are trusted as cluster members.
Exploitation
- Exploited in the wild: No evidence found.
- Public proof of concept: Unknown.
- NVD status at time of analysis: Awaiting Analysis.
Our recommendation
- Check whether any MongoDB cluster uses clusterAuthMode x509 with extension-based or custom cluster membership.
- If yes, upgrade to the fixed versions with priority.
- If no, include the upgrade in the next regular maintenance cycle.
- Inventory MongoDB versions and restrict access to cluster member ports.
- Verify the vendor advisory before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MongoDB Jira SERVER-130169 jira.mongodb.org
- MongoDB Security Alerts www.mongodb.com
- CVE-2026-120807 on threatint cve.threatint.com
- CVE-2026-120807 on Strix www.strix.ai
- MongoDB internal authentication documentation www.mongodb.com
- Rotate X.509 membership certificates www.mongodb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:58.
Original description (NVD)
A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated internal privileges when a specific deployment configuration is in use. An internal check, which prevents a certificate recognized as a cluster member from also being treated as a regular user, does not correctly distinguish between certain error conditions encountered during user lookup. Under certain timing conditions, this can cause the check to be bypassed, granting the connection full internal system privileges. Triggering this issue requires possession of a valid cluster-member TLS certificate, non-default X.509 cluster authentication configuration, and specific conditions during the user cache lookup process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.