EUVD-2026-56921
GHSA-jx4v-jf9c-3rh7
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent access to inter-node traffic (AV:A) with conditional downgrade success (AC:H), no auth needed (PR:N); recovered superuser credential crosses into full cluster control (S:C) with total C/I/A impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.
AnalysisAI
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the deployment to use MongoDB internal cluster authentication (keyfile/SCRAM-based member auth) that is downgradeable, and the attacker must have adjacent network access (AV:A) to the intra-cluster member-to-member connection channel - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N, all VC/VI/VA and subsequent SC/SI/SA = H, score 9.0 Critical) signals unauthenticated but adjacent-network access with an attack requirement (AT:P) - meaning exploitation is not a trivial single-shot remote attack but depends on being positioned to influence the intra-cluster handshake and on certain conditions being met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who gains a foothold on the same network segment as a MongoDB cluster (e.g. a compromised host in the same VLAN as the replica-set members) positions to observe or influence a new member-to-member connection setup and forces the internal authentication to negotiate a weaker mechanism. … |
| Remediation | Upgrade MongoDB Server to the patched release identified in MongoDB's advisory - consult https://jira.mongodb.org/browse/SERVER-130264 for the exact fixed versions, as no specific patched version number is provided in the available data (No vendor-released patch version independently confirmed at time of analysis). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all MongoDB deployments to identify which use replica sets or sharded clusters and document network exposure of cluster member communication. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allOut-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today