A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://jira.mongodb.org/browse/SERVER-130268 |
|
History
Tue, 10 Nov 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover. | |
| Title | Credential-handle retention via missing flag set in Windows Kerberos auth handler | |
| Weaknesses | CWE-772 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-11-10T20:03:44.297Z
Reserved: 2026-11-02T22:54:13.381Z
Link: CVE-2026-120804
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T20:18:50.593
Modified: 2026-11-10T20:18:50.593
Link: CVE-2026-120804
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses