MongoDB: Authenticated User Bypasses Transaction Coordination
CVE-2026-18709 Published on August 11, 2026
Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
Vulnerability Analysis
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-18709 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-18709
Want to know whenever a new CVE is published for MongoDB? stack.watch will email you.
Affected Versions
MongoDB Server:- Version 8.3.0 and below 8.3.8 is affected.
- Version 8.0 and below 8.0.29 is affected.
- Version 7.0 and below 7.0.40 is affected.