Vulnerability · Published Aug 11, 2026 · Assigned by mongodb
CVE-2026-18691Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
High 8.8
In plain English
A high-severity security flaw in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 – before 8.3.88.0 – before 8.0.297.0 – before 7.0.40 |
Weakness: CWE-757 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H