Which versions of MongoDB Server are affected by CVE-2026-18697?

MongoDB Server's sharded cluster deployments are vulnerable to an unauthenticated denial-of-service attack in the aggregation framework that crashes mongos routers and severs all client connections.. A patch is available.

How to fix or mitigate CVE-2026-18697?

Within 24 hours: Identify all MongoDB sharded cluster deployments and document mongos router locations and their client dependencies. Within 7 days: Implement network-level ingress controls to restrict aggregation framework access to trusted internal clients only, deploy a load balancer or proxy layer that inspects aggregation commands, and establish automated monitoring and alerting for mongos process crashes. Within 30 days: Monitor MongoDB security advisories for an available patch release and prepare a deployment plan for production upgrades; in parallel, evaluate upgrading affected MongoDB versions or implementing application-level request validation to detect and reject suspicious aggregation payloads before they reach mongos.

MongoDB Server CVE-2026-18697

Q: What is the CVSS score of CVE-2026-18697?

CVE-2026-18697 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-56910 HIGH

Reachable Assertion (CWE-617)

2026-08-11 mongodb

GHSA-wxp5-7rcf-9m3q

Denial Of Service MongoDB Mongodb Server

8.7

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, no auth or complexity required; impact is solely availability loss (mongos crash); scope unchanged as other systems are not directly compromised.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 20:19 EUVD

Analysis Generated

Aug 11, 2026 - 20:16 vuln.today

CVE Published

Aug 11, 2026 - 18:39 cve.org

HIGH 8.7

DescriptionCVE.org

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

AnalysisAI

Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.

Technical ContextAI

MongoDB's aggregation framework processes pipeline commands (e.g., $match, $group, $lookup) through the mongos router in sharded cluster topologies. CWE-617 (Reachable Assertion) describes a code path where an assertion - typically a developer-inserted invariant check - can be triggered by external input rather than being reachable only under controlled internal conditions. When the assertion fails, the C runtime calls abort(), terminating the mongos process immediately. This is distinct from a handled error: the process does not gracefully reject the command but instead crashes outright. The affected CPE (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*) uses a wildcard version range, indicating the issue spans multiple MongoDB Server releases. The JIRA ticket SERVER-130110 filed by MongoDB's own engineering team is the primary reference, suggesting this was internally discovered and responsibly disclosed.

RemediationAI

The primary remediation is to upgrade MongoDB Server to a patched version once released by MongoDB; however, no specific fix version is confirmed from available data - monitor the MongoDB release notes and the JIRA ticket at https://jira.mongodb.org/browse/SERVER-130110 for the target patch version. Until a patch is applied, consider restricting network access to mongos listener ports (default TCP 27017) using firewall rules or network ACLs so that only trusted application servers and database clients can submit aggregation commands - this trades accessibility for attack surface reduction. If your deployment uses MongoDB Atlas (managed service), MongoDB typically applies patches transparently; verify your Atlas cluster version against the advisory. For self-managed deployments, enabling MongoDB authentication and restricting anonymous access (if not already enforced) would not eliminate this vulnerability given the PR:N vector, but would add a layer of access control. Note that restarting a crashed mongos process restores service immediately; consider adding process supervision (systemd restart policies or Kubernetes liveness probes) as a resilience measure to reduce downtime from repeated triggering.