Is there a patch available for CVE-2026-5170?

Yes, a patch is available for CVE-2026-5170. Update the affected software to the latest version immediately.

MongoDB CVE-2026-5170

Q: What is the CVSS score of CVE-2026-5170?

CVE-2026-5170 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17115 MEDIUM

Reachable Assertion (CWE-617)

2026-03-30 mongodb

Denial Of Service MongoDB Mongodb Server

6.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 30, 2026 - 16:00 euvd

EUVD-2026-17115

Analysis Generated

Mar 30, 2026 - 16:00 vuln.today

CVE Published

Mar 30, 2026 - 15:28 nvd

MEDIUM 6.0

DescriptionCVE.org

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set.

This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

AnalysisAI

Denial of service in MongoDB Server allows authenticated users with limited cluster privileges to crash a mongod process during replica set to sharded cluster promotion, causing potential primary failure. Affects MongoDB 8.2 before 8.2.2, 8.0.18+, and 7.0.31+. No public exploit code or active exploitation confirmed; CVSS 5.3 reflects the narrow attack window and authentication requirement.

Technical ContextAI

This vulnerability exists in MongoDB's cluster configuration transition logic, specifically during the window when a replica set is being promoted to a sharded cluster architecture. The underlying cause (CWE-617: Reachable Assertion) indicates improper handling of an edge case in state transition code that allows a specially-timed request from an authenticated user to trigger an assertion failure, crashing the mongod process. The vulnerability requires the attacker to have cluster access with limited privilege actions, meaning they possess some form of authentication credential with restricted permissions, and must execute their action during the unpredictable promotion window when cluster topology is being modified.

RemediationAI

MongoDB users should upgrade to patched versions: MongoDB Server 8.2.2 or later, a patched 8.0.x version (8.0.19 or later based on standard MongoDB versioning), and a patched 7.0.x version (7.0.32 or later). Until patching is possible, administrators should avoid cluster promotion operations (replica set to sharded cluster transitions) in production environments, or schedule such operations during maintenance windows with reduced authentication activity. For immediate risk mitigation, restrict cluster privileges to only the minimum necessary accounts and audit authentication logs for any accounts with cluster configuration permissions. Detailed remediation guidance and patch availability can be found in the MongoDB advisory at https://jira.mongodb.org/browse/SERVER-101758.