MongoDB Server: Improper privilege management in sharding subsystem
Summary
The sharding subsystem of MongoDB Server does not properly manage privileges. A user with certain shard-level administrative privileges can cause persisted internal coordination state to be reprocessed with elevated internal authority, so operations beyond their authorized scope can be carried out, including changes to cluster-wide security configuration. Exploitation requires an authenticated session directly against a cluster member and can lead to unauthorized access to and modification of cluster data.
Affected
- MongoDB Server 9.0.0 before 9.0.7
- MongoDB Server 8.3.0 before 8.3.16
- MongoDB Server 8.0.0 before 8.0.37
- Default configuration: listed as unaffected in the CVE record
- Other branches: Unknown.
Fixed in
- MongoDB Server 9.0.7
- MongoDB Server 8.3.16
- MongoDB Server 8.0.37
Workaround
Unknown. No vendor-documented workaround found.
- Interim measure (not vendor-documented): restrict shard-level administrative roles and limit direct access to cluster members.
Exploitation
- No exploitation in the wild and no public proof of concept found at the time of writing.
- Status is unknown rather than confirmed safe.
Our recommendation
- Check whether sharded clusters are in use; unsharded deployments are likely not affected.
- Update to 9.0.7, 8.3.16 or 8.0.37 (or a later release) within the normal patch cycle.
- Review and restrict shard-level administrative roles and direct access to cluster members.
- Audit cluster security configuration and user accounts for unexpected changes or unknown root users.
- Monitor for unusual administrative activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120814 www.cve.org
- MongoDB Jira ticket SERVER-133600 jira.mongodb.org
- MongoDB alerts www.mongodb.com
- Threatint mirror CVE-2026-120814 cve.threatint.com
- Release write-up for MongoDB Server 9.0.7 security fixes securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:58.
Original description (NVD)
An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data across the cluster.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.