EUVD-2026-47793Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low privileges; AT:P prerequisite has no 3.1 equivalent so AC:L/PR:L is retained; no confidentiality impact applies per description.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.
AnalysisAI
MongoDB's cursor termination authorization logic fails to scope privileges to the correct database namespace, allowing an authenticated low-privilege user to terminate active cursors on databases they do not administer. Exploitation requires the attacker to hold cursor termination rights on at least one database, limiting the practical threat to malicious or compromised internal users. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
MongoDB, a widely-deployed NoSQL document database, implements per-database role-based access controls for administrative operations including cursor lifecycle management. Cursors represent server-side iterators over query result sets, and MongoDB exposes a killCursors command to terminate them. The root cause is CWE-863 (Incorrect Authorization): the privilege check governing cursor termination does not enforce that the privilege is scoped to the same database namespace as the target cursor. A user granted killCursors or equivalent privilege on database A can therefore affect cursors on database B. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) captures that exploitation is network-accessible and low-complexity once prerequisites are met, but requires an authenticated low-privilege user who specifically holds cursor termination rights on at least one database. The issue is tracked in MongoDB's own Jira as SERVER-128198, filed by the MongoDB CNA.
RemediationAI
Consult the MongoDB Jira issue SERVER-128198 (https://jira.mongodb.org/browse/SERVER-128198) for patch availability and the confirmed fixed version, as no specific patched release has been independently identified in the available intelligence. No vendor-released patch version can be cited at time of analysis. As a compensating control, restrict cursor termination privileges (killCursors or equivalent role grants) to only the specific users and databases that operationally require them, removing broad grants that expand the cross-database disruption surface. Enabling MongoDB's audit log and alerting on killCursors operations targeting namespaces inconsistent with the issuing user's assigned databases can serve as a detection measure. These controls do not eliminate the underlying flaw but reduce exploitation opportunity until an official patch is applied.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr
A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today