CVE-2026-18709: Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18709?
The severity of CVE-2026-18709 is medium with a score of 6.4.
What does CVE-2026-18709 affect?
CVE-2026-18709 affects MongoDB Server, specifically related to sharded transaction commit and abort handling.
What are the risks associated with CVE-2026-18709?
The risks include cross-shard data inconsistency and potential cluster clock corruption due to improper transaction handling.
How do I fix CVE-2026-18709?
To fix CVE-2026-18709, ensure that proper authorization mechanisms are implemented for transaction commit and abort processes.
Who is impacted by CVE-2026-18709?
Authenticated users with direct network access to a shard in MongoDB Server are impacted by CVE-2026-18709.