CVE-2026-120817

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1208187.1A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed CVE-2026-1208194.3A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only re CVE-2026-120827.5The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthent CVE-2026-1208204.3MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are c CVE-2026-1208216.5A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipel CVE-2026-1208226.7MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because t CVE-2026-1208234.3A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an ac CVE-2026-1208248.8A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document CVE-2026-1208256.5An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privile CVE-2026-1208266.5An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write CVE-2026-1208287.5A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that CVE-2026-120838.1The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perf