MongoDB Server: Use-after-free in time-series bucket validation
Summary
A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a bucket document during a write. An authenticated user with privileges to write bucket documents directly can crash the server process and, under certain conditions, execute arbitrary code with the privileges of the mongod process. The CNA rates the issue CVSS 4.0 8.7 (High).
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Note: The vendor ticket states that 7.0 is not affected via the strict-validation path, and the catalog-reopen path is still under investigation.
Fixed in
- Upgrade to MongoDB Server 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later in the same branch).
Workaround
- Unknown. No vendor workaround found in the sources.
- Restrict write access to time-series bucket collections to the minimum number of trusted accounts until patched.
Exploitation
- No in-the-wild exploitation reported. The CVE is not listed in CISA KEV (as of 10 Nov 2026).
- The vendor ticket states that an external reporter demonstrated escalation to arbitrary command execution.
- No public exploit found in Metasploit, Exploit-DB or as a Nuclei template (as of 10 Nov 2026, OffSeq aggregator).
Our recommendation
- Inventory all MongoDB Server instances and check their versions against the affected ranges.
- Patch affected instances in the next maintenance window, prioritising servers reachable from outside the internal network.
- Review accounts with write roles on bucket collections and remove unneeded privileges.
- Keep MongoDB off the public internet and monitor logs for unexpected crashes or write activity on time-series collections.
- Re-check NVD and CISA KEV once NVD analysis is published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MongoDB Jira SERVER-136505 jira.mongodb.org
- CVE Record CVE-2026-120824 www.cve.org
- Strix CVE-2026-120824 www.strix.ai
- OffSeq Radar CVE-2026-120824 radar.offseq.com
- MongoDB Time-Series Bucketing documentation www.mongodb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:58.
Original description (NVD)
A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.