by Kastro
Paper/Archive/CVE-2026-18691

CVE-2026-18691

MongoDB MongoDB Server — Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure

EPSS 0.4%CVSS 9.0
critical.is priorityof 100
33
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 29.3.293 × 205.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.

Affected

ProductAffectedFixed inSource
MongoDB Server8.3.0 – < 8.3.88.3.8CNA
MongoDB Server8.0 – < 8.0.298.0.29CNA
MongoDB Server7.0 – < 7.0.407.0.40CNA

Scores by source

mongodb (CNA)9.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
mongodb (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjira.mongodb.org/browse/SERVER-130264