CVE-2026-18709

Awaiting Analysis Awaiting Analysis - Queue

MongoDB Server Transaction Coordination Bypass

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18709

EUVD

EUVD-2026-56883

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB Server allows an authenticated user with network access to a shard to improperly commit or abort a prepared transaction. This bypasses the normal transaction coordination process, potentially causing data inconsistency across shards, cluster clock corruption, and breaking transaction atomicity guarantees.

Detection Guidance

Detection requires monitoring MongoDB server logs for unusual transaction states or inconsistencies across shards. Check for prepared transactions that were committed or aborted without proper coordination. Use MongoDB commands like rs.status() to inspect replica set status and db.currentOp() to identify long-running transactions.

Impact Analysis

An attacker could exploit this to corrupt data across multiple shards, leading to incorrect or inconsistent information in your database. This may cause application failures, data loss, or unreliable results in queries and transactions.

Compliance Impact

This vulnerability could lead to data integrity issues, which may violate compliance requirements for GDPR (data accuracy) and HIPAA (data integrity and security). Unreliable or corrupted data could result in non-compliance and potential legal or regulatory penalties.

Mitigation Strategies

Apply the latest MongoDB Server patch or update to a version that fixes this issue. Ensure all shards and cluster components are updated. Restrict network access to authenticated users only and monitor for cross-shard data inconsistencies or transaction failures.

Hi! I’m here to help you understand CVE-2026-18709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70