MongoDB Server: Race condition in geospatial schema validation
Summary
A race condition in the schema validation component of MongoDB Server occurs when concurrent writes are checked against a collection validator that uses geospatial query operators. An authenticated user with write privileges can trigger it, and the server may terminate unexpectedly. The impact is a denial of service; the CVSS vector shows no confidentiality or integrity impact.
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Versions 6.0 and older: Unknown (not listed in the CNA record)
- The default configuration is unaffected; the issue requires a validator with geospatial query operators.
Fixed in
- 9.0.7
- 8.3.16
- 8.0.37
- 7.0.48
Workaround
- No vendor-stated workaround. Apply the fixed versions.
- Limit write access to trusted users (general hardening, not vendor guidance).
Exploitation
- Not known to be exploited as of 10 Nov 2026, according to aggregator data.
- No public proof of concept found; absence in searches is not proof of absence.
- Not listed in CISA KEV in the snapshot checked.
Our recommendation
- Check whether the server runs 7.0, 8.0, 8.3 or 9.0 below the fixed version and patch in the next maintenance window.
- Patch sooner if database write access is shared with untrusted users or the database is reachable beyond the internal network.
- Apply the whole MongoDB release that was published on the same date, as other fixes in that batch are more serious.
- Review which accounts have write privileges and monitor for unexpected server restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120817 www.cve.org
- MongoDB Jira SERVER-135655 jira.mongodb.org
- MongoDB Alerts www.mongodb.com
- Strix CVE-2026-120817 www.strix.ai
- OffSeq Radar CVE-2026-120817 radar.offseq.com
- Threatint CVE-2026-120817 cve.threatint.com
- SecurityOnline MongoDB vulnerabilities 2026 securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:05.
Original description (NVD)
A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.