Skip to content
MongoDBCVE-2026-18691

An issue in MongoDB Server's intra-cluster connection setup

Critical9.0CVE-2026-18691 · Published Aug 11, 2026 · updated Sep 16, 2026

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.

MongoDB advisory

Affected versions

PackageAffectedFixed in
MongoDB Server
Product
>= 8.3.0, < 8.3.88.3.8
>= 8.0, < 8.0.298.0.29
>= 7.0, < 7.0.407.0.40
Details and references
CVSS 4.0
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-757

More MongoDB advisories

All MongoDB
Advisory
Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
Medium6.5Aug 11
MongoDB Server: improper authorization
High7.2Aug 11
MongoDB Server: use after free
High7.1Aug 11
MongoDB Server: missing authorization
High7.1Aug 11
MongoDB Server: untrusted input in a security decision
High7.1Aug 11
MongoDB Server: use after free
High7.5Aug 11

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.