CVE-2026-18691: Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18691?
The severity of CVE-2026-18691 is high with a score of 8.8.
What type of vulnerability is CVE-2026-18691?
CVE-2026-18691 is classified as an improper authentication vulnerability in MongoDB.
What impact does CVE-2026-18691 have on MongoDB?
CVE-2026-18691 can lead to credential exposure in MongoDB intra-cluster connections.
How do I fix CVE-2026-18691?
To fix CVE-2026-18691, ensure that all MongoDB clusters are configured with proper network access controls and authentication mechanisms.
Who is affected by CVE-2026-18691?
CVE-2026-18691 affects users of MongoDB Server that utilize intra-cluster connections.