Vulnerability · Published Dec 9, 2025 · Assigned by mongodb
CVE-2025-14345Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
Medium 4.2
In plain English
A medium-severity security flaw in MongoDB Server from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact. This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | MongoDB Server | 7.0 – before 7.0.268.0 – before 8.0.168.2 – before 8.2.2 |
Weakness: CWE-667 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N