MongoDB Server: Incorrect authorization check in localhost exception
Summary
An incorrect authorization check in the MongoDB Server authorization subsystem allows an unauthenticated user with local host access to create users with administrative privileges on a server where authorization is enabled. The flaw occurs when the first user is created in the "$external" database, because the localhost exception then remains open. An attacker could read stored data and credentials, modify data, or disrupt the server.
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Default configuration: unaffected
Fixed in
- Upgrade to MongoDB Server 9.0.7 or later
- Upgrade to MongoDB Server 8.3.16 or later
- Upgrade to MongoDB Server 8.0.37 or later
- Upgrade to MongoDB Server 7.0.48 or later
- Fixed versions are taken from the Jira ticket SERVER-134872; the vendor advisory was not retrieved and should be verified.
Workaround
Unknown. No vendor mitigation was found. A benchmark setting (enableLocalhostAuthBypass=0) may be relevant, but whether it blocks this flaw is unconfirmed; test in a non-production environment first.
Exploitation
- Attack vector: local (requires local host access)
- No known exploitation in the wild at the time of writing
- No public proof of concept known
- Not listed in CISA KEV
- NVD status: Awaiting Analysis
Our recommendation
- Inventory all MongoDB instances and versions, including bundled and Docker-based installs.
- Plan upgrades to the fixed releases once the vendor advisory is confirmed.
- Until then, restrict local access on database hosts and avoid sharing them with untrusted workloads.
- Review the localhost exception configuration and test the impact in a non-production environment.
- Re-check NVD and the MongoDB advisory in a few days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120815 www.cve.org
- MongoDB Jira ticket SERVER-134872 jira.mongodb.org
- MongoDB community security update, November 10, 2026 www.mongodb.com
- CIS MongoDB 5 Benchmark Level 1 (Tenable audit) www.tenable.com
- Strix AI CVE-2026-120815 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:10.
Original description (NVD)
An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.