CVE-2026-120814

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 9.0.7 MongoDB Server versions prior to 8.3.16

Description An improper privilege management issue exists in the sharding subsystem. A user with specific shard-level administrative privileges can cause the persisted internal coordination state to be reprocessed with elevated internal authority. Since this state is trusted without re-validation, operations can be performed outside the user's authorized scope, such as modifying cluster-wide security configurations. This can be triggered via an authenticated session directly against a cluster member and may lead to unauthorized access to and modification of data across the cluster, including the creation of a persistent cluster root user through MultiUpdateCoordinator state replay.

Recommendations Update to version 9.0.7 or later. Update to version 8.3.16 or later.