CVE-2026-120804

EUVD-2026-122886

10.11.2026, 20:18

A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
mongodb	CNA	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
mongodb	mongodb	9.0.0 ≤ 𝑥 < 9.0.7	CNA
mongodb	mongodb	8.3.0 ≤ 𝑥 < 8.3.16	CNA
mongodb	mongodb	8.0.0 ≤ 𝑥 < 8.0.37	CNA
mongodb	mongodb	7.0.0 ≤ 𝑥 < 7.0.48	CNA

Common Weakness Enumeration

CWE-772 - Missing Release of Resource after Effective Lifetime
The software does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References

https://jira.mongodb.org/browse/SERVER-130268