Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-120817 EUVD-2026-122833GHSA-qc8p-qp8m-4cmq

Post-authentication race condition in MongoDB Server geospatial schema validation

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by mongodb

Description

A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 9.0.0 – < 9.0.7, 8.3.0 – < 8.3.16, 8.0.0 – < 8.0.37, 7.0.0 – < 7.0.48 9.0.7

Advisories 1

References