CVE-2026-120804
HIGH
MEDIUM
Priority: 0.05
BB Relevance:
77/100
Published: 2026-11-10
Modified: 2026-11-10
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
Present
VC:
None
VI:
None
VA:
High
Description
A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| MongoDB | MongoDB Server | 9.0.0 < 9.0.7 |
| MongoDB | MongoDB Server | 8.3.0 < 8.3.16 |
| MongoDB | MongoDB Server | 8.0.0 < 8.0.37 |
| MongoDB | MongoDB Server | 7.0.0 < 7.0.48 |