MongoDB Server: Improper authorization in sharded view handling
Summary
In sharded MongoDB deployments, a user with basic read-write rights on one database can define a view whose processing is not fully checked for privileges. Reading that view may expose data belonging to other databases on the same shard. The attacker needs a valid account, and the flaw only matters where sharded clusters are used.
Affected
- MongoDB Server 9.0.0 to before 9.0.7 (default configuration unaffected)
- Versions outside the 9.0.x line: Unknown.
Fixed in
- MongoDB Server 9.0.7 (listed as fix version in the Jira ticket SERVER-137361)
- Vendor advisory confirming the fix: Unknown.
Workaround
- No vendor mitigation found.
- Until 9.0.7 is deployed, review which users hold write rights on databases in the cluster and restrict them to the minimum needed.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalogue.
- No public proof of concept found at the time of research.
Our recommendation
- Identify sharded MongoDB clusters and their 9.0.x versions.
- Schedule an upgrade to MongoDB 9.0.7 or later.
- Restrict write roles on shared clusters and review database accounts.
- Keep MongoDB off the internet and limit network access to the database port.
- Re-check the Jira ticket and MongoDB security bulletins for confirmation and for other affected branches.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record CVE-2026-120826 www.cve.org
- MongoDB Jira ticket SERVER-137361 jira.mongodb.org
- MongoDB 9.0 release notes www.mongodb.com
- MongoDB 9.0.7 announcement www.mongodb.com
- Strix CVE-2026-120826 www.strix.ai
- OffSeq threat summary radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:04.
Original description (NVD)
An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.