CVE-2026-18691

Awaiting Analysis Awaiting Analysis - Queue

MongoDB Server Intra-Cluster Authentication Mechanism Weakness

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18691

EUVD

EUVD-2026-56921

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-757	A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in MongoDB Server's intra-cluster connection setup. It allows a network-accessing party to influence the authentication mechanism used between replica set members. Under specific conditions, this could cause the cluster's shared internal credential to be sent in a less-protected form, potentially allowing credential recovery and misuse for authentication as the internal superuser.

Detection Guidance

This vulnerability involves intra-cluster authentication mechanism manipulation in MongoDB. Detection requires checking MongoDB server logs for unusual authentication events or failed connections between replica set members. Monitor for connections using weaker authentication methods than expected. Review MongoDB configuration files for unexpected changes to security settings.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to MongoDB nodes as the internal superuser. This could lead to full control over the database cluster, data breaches, unauthorized data manipulation, or service disruption. The impact depends on the sensitivity of the data stored and the privileges of the internal superuser.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, triggering mandatory breach notifications and potential fines. Organizations using MongoDB must address this to maintain compliance with data protection regulations.

Mitigation Strategies

Update MongoDB Server to the latest patched version to address the intra-cluster connection authentication issue. Ensure network access to replica set members is restricted to trusted sources only.

Hi! I’m here to help you understand CVE-2026-18691. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70