CVE-2026-120804

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1208054.3In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-CVE-2026-1208065.5A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a CVE-2026-1208076.6A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated inte CVE-2026-1208087.4An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connection CVE-2026-1208096.8A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time CVE-2026-120815.0The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unser CVE-2026-1208106.5An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending CVE-2026-1208115.9A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference CVE-2026-1208126.5An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Unco CVE-2026-1208135.9An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silentl CVE-2026-1208147.2An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrati CVE-2026-1208158.4An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to