Loading vulnerability…
Local Administrative Privilege Escalation in MongoDB Server
CVE-2026-120815 is an incorrect authorization check in the MongoDB Server authorization subsystem that may allow an unauthenticated party with local host access to obtain database administrative privileges even when authorization is enabled. Affected versions are 7.0.0 through versions before 7.0.48, 8.0.0 through versions before 8.0.37, 8.3.0 through versions before 8.3.16, and 9.0.0 through versions before 9.0.7. Successful exploitation may expose stored data and credentials, permit unauthorized data modification, and compromise server availability. The specific vulnerable function is not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated local attacker may gain administrative control over the database server, compromising the confidentiality of stored data and credentials, the integrity of database contents, and server availability. Operating-system privilege escalation or arbitrary code execution is not established.
If you can’t patch tonight, do this now.
As an interim precaution, restrict local access to database hosts to trusted administrators and necessary service accounts. No vendor-confirmed workaround is identified. Enabling database authorization alone does not prevent this vulnerability.
Patch, then assume compromise.
Upgrade affected MongoDB Server installations to version 7.0.48, 8.0.37, 8.3.16, or 9.0.7, or a later release in the corresponding branch.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.