EUVD-2026-56883
GHSA-g2m8-vcxw-5h4c
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network vector and PR:L for required authentication; S:C chosen because cross-shard integrity corruption extends impact beyond the directly targeted shard.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
AnalysisAI
MongoDB Server's sharded cluster transaction coordination is vulnerable to an authorization bypass that allows an authenticated, low-privileged user with direct adjacent-network access to a shard process to illegitimately commit or abort in-progress prepared transactions - actions that are normally reserved for the designated transaction coordinator. Exploitation can produce cross-shard data inconsistency, cluster clock corruption, and broken atomicity guarantees across the distributed database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete prerequisites must all be satisfied simultaneously: (1) The attacker must possess valid MongoDB credentials with at least low-privilege access to the cluster (PR:L); (2) the attacker must have direct adjacent-network access to a shard's port (typically 27018) - access only to the mongos router tier (the normal application-facing layer) is not sufficient, since mongos does not expose the vulnerable shard-level transaction endpoints; (3) an active prepared transaction must be in-flight on the targeted shard at the moment of the attack, creating a narrow exploitation window (AT:P prerequisite). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.9 (Medium) is appropriately calibrated for this vulnerability given the substantial exploitation prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privilege MongoDB credentials - for example via credential stuffing against a developer account - and has adjacent network access to an internal shard port (e.g., through a compromised internal host or misconfigured network segment) monitors the cluster for in-flight distributed transactions. During a brief window when a prepared transaction is in-flight, the attacker sends a crafted abort command directly to the target shard, bypassing the transaction coordinator, causing the shard to unilaterally roll back a transaction that other shards have already committed. … |
| Remediation | Upgrade MongoDB Server to 8.3.8 or later (for 8.3.x deployments), 8.0.29 or later (for 8.0.x deployments), or 7.0.40 or later (for 7.0.x deployments) - these are the vendor-confirmed fix versions per EUVD-2026-56883. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today