Loading vulnerability…
MongoDB Server Geospatial Schema Validation Race Condition
CVE-2026-120817 is a race condition in MongoDB Server's schema validation component. Concurrent writes checked against a collection validator using geospatial query operators can trigger unexpected server termination. Exploitation requires an authenticated user with write privileges. Affected versions are 7.0.0 through versions before 7.0.48, 8.0.0 through versions before 8.0.37, 8.3.0 through versions before 8.3.16, and 9.0.0 through versions before 9.0.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated user with write privileges can cause MongoDB Server to terminate unexpectedly, resulting in denial of service and interruption of database availability. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
No vendor-provided workaround is specified. As interim precautions, restrict write privileges to trusted users and assess whether concurrent writes against collections with validators using geospatial query operators can be limited. These precautions are not a substitute for upgrading.
Patch, then assume compromise.
Upgrade MongoDB Server to version 7.0.48, 8.0.37, 8.3.16, or 9.0.7, or a later release in the corresponding branch.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.