Dashboard / CVE-2026-120817

CVE-2026-120817

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-11-10 Modified: 2026-11-10 First seen: 2026-11-10 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: None
VI: None
VA: High

Description

A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
MongoDB MongoDB Server 9.0.0 < 9.0.7
MongoDB MongoDB Server 8.3.0 < 8.3.16
MongoDB MongoDB Server 8.0.0 < 8.0.37
MongoDB MongoDB Server 7.0.0 < 7.0.48

References & Advisories (1)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.33%
Raw Score 0.003260
Percentile 26.1%
Date 2026-11-12

Intelligence Sources

mitre ref →
nvd ref →

External Links