CVE-2026-18691

{
  "id": "CVE-2026-18691",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T19:17:22.903",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment."
    },
    {
      "lang": "es",
      "value": "Un problema en la configuración de conexión intra-clúster del servidor MongoDB podría permitir a una parte con acceso de red adecuado influir en qué mecanismo de autenticación se utiliza cuyo un miembro del conjunto de réplicas se conecta a otro. Bajo ciertas condiciones, esto podría causar que la credencial interna compartida del clúster se transmita en una forma menos protegida, permitiendo potencialmente que esa credencial sea recuperada. Si se recupera, la credencial podría usarse para autenticarse como el superusuario interno en los nodos de la implementación."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MongoDB",
          "product": "MongoDB Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.3.0",
              "lessThan": "8.3.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.0",
              "lessThan": "8.0.29",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "7.0",
              "lessThan": "7.0.40",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T20:21:49.480663Z",
          "id": "CVE-2026-18691",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-757"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.0.0",
              "versionEndExcluding": "7.0.40",
              "matchCriteriaId": "F3DB18E4-812C-4E04-802D-5D6B61CE9D1B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndExcluding": "8.0.29",
              "matchCriteriaId": "4DC64BC6-1D47-4809-9616-95A7CF59DC37"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.2.0",
              "versionEndIncluding": "8.2.12",
              "matchCriteriaId": "7BCD6B05-9FD5-4283-A2AC-8B625425597F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.3.0",
              "versionEndExcluding": "8.3.8",
              "matchCriteriaId": "6EE4503A-F53C-432E-9DDB-F488DD989E8A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*",
              "matchCriteriaId": "0FB52026-6C88-4401-84B5-3A070F0906D4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*",
              "matchCriteriaId": "8D32A105-731C-493E-8CBF-639204CDAC7C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*",
              "matchCriteriaId": "D56E512D-83F8-4D51-8690-E92F6A006822"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://jira.mongodb.org/browse/SERVER-130264",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Issue Tracking"
      ]
    }
  ]
}