An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress… (CVE-2026-18709)
CVE-2026-18709 is a vulnerability in MongoDB Server that allows an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction. This bypasses the intended transaction coordination process and can lead to cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees. The vulnerability has a CVSS score of 6.4, indicating medium severity. No affected versions or patch information are provided in the available data.
AI Analysis
Technical Summary
This vulnerability in MongoDB Server enables an authenticated user who has direct network access to a shard to improperly commit or abort an ongoing prepared transaction. This action bypasses the normal transaction coordination mechanisms, potentially causing cross-shard data inconsistencies, corruption of the cluster clock, and breaking the atomicity guarantees of transactions. The issue is classified under CWE-862 (Missing Authorization). There is no information about affected versions or available patches, and no known exploits in the wild have been reported.
Potential Impact
An attacker with authenticated access and direct network access to a shard can disrupt transaction integrity by improperly committing or aborting prepared transactions. This can lead to inconsistent data across shards, corruption of cluster timekeeping, and violation of transaction atomicity, potentially impacting database reliability and correctness.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to shards and limit network exposure to trusted entities to reduce risk.
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress… (CVE-2026-18709)
Description
CVE-2026-18709 is a vulnerability in MongoDB Server that allows an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction. This bypasses the intended transaction coordination process and can lead to cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees. The vulnerability has a CVSS score of 6.4, indicating medium severity. No affected versions or patch information are provided in the available data.
CVSS v3.1
Score 6.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in MongoDB Server enables an authenticated user who has direct network access to a shard to improperly commit or abort an ongoing prepared transaction. This action bypasses the normal transaction coordination mechanisms, potentially causing cross-shard data inconsistencies, corruption of the cluster clock, and breaking the atomicity guarantees of transactions. The issue is classified under CWE-862 (Missing Authorization). There is no information about affected versions or available patches, and no known exploits in the wild have been reported.
Potential Impact
An attacker with authenticated access and direct network access to a shard can disrupt transaction integrity by improperly committing or aborting prepared transactions. This can lead to inconsistent data across shards, corruption of cluster timekeeping, and violation of transaction atomicity, potentially impacting database reliability and correctness.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to shards and limit network exposure to trusted entities to reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g2m8-vcxw-5h4c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18709"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a7c9b71bf8831d539ce0551
Added to database: 08/12/2026, 16:12:33 UTC
Last enriched: 08/12/2026, 17:26:12 UTC
Last updated: 08/13/2026, 03:41:00 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.