Intra-cluster Connection Vulnerability in MongoDB Server

CVE-2026-18691

What is CVE-2026-18691?

A vulnerability exists in the intra-cluster connection setup of MongoDB Server, where an attacker with specific network access may influence the authentication mechanism used by a replica set member when connecting to others. This scenario could result in the cluster's internal credential being transmitted in an insecure manner, heightening the risk of credential recovery. If an attacker manages to recover these credentials, they may gain unauthorized internal superuser access to nodes in the deployment.

References