CVE-2026-18691High· 8.8▾ TwilightAn issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.4%
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.
mongodb >= 7.0.0, < 7.0.40mongodb >= 8.0.0, < 8.0.29mongodb >= 8.2.0, <= 8.2.12mongodb >= 8.3.0, < 8.3.8mongodb = 9.0.0mongodb = 9.1.0Upgrade past the affected range:
mongodb 8.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11979Medium· 5.3An authorized user may crash the MongoDB server by causing buffer over-read
CVE-2025-14345Medium· 4.2A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very sho…
CVE-2025-10060Medium· 6.5MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit
CVE-2026-9737Medium· 6.5During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case
CVE-2026-8843Medium· 6.5Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server
CVE-2026-89099High· 7.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption