CVE-2026-18691

Name of the Vulnerable Software and Affected Versions MongoDB Server (affected versions not specified)

Description An issue in the intra-cluster connection setup allows an attacker with suitable network access to influence the authentication mechanism used during connections between replica set members. This can lead to the transmission of the cluster's shared internal credential in a less-protected form, potentially enabling its recovery. A recovered credential could be used to authenticate as the internal superuser across nodes in the deployment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.