Executive brief
MongoDB Server's internal communication between replica set members is vulnerable to downgrade attacks that could expose the cluster's shared internal credential. An attacker with network access can intercept the authentication handshake and trick a node into using weaker, less-protected authentication methods, potentially revealing the internal superuser password in cleartext. This credential could then be used to gain complete control over the entire database cluster.
Technical details
This is a SASL mechanism downgrade vulnerability in MongoDB Server's intra-cluster connection setup. The root cause is that TLConnectionSetupHook::validateHost copies the saslSupportedMechs array from unauthenticated hello replies directly into _saslMechsForInternalAuth without validating against an allowlist, allowing an attacker to advertise only the PLAIN mechanism. When PLAIN is selected for internal authentication, getInternalAuthParams returns the raw keyfile string as a cleartext password. An attacker with network access (adjacent or network position) can forge a hello reply advertising only PLAIN to trigger transmission of the cluster's internal credential in cleartext. The vulnerability requires suitable network access to intercept and modify the unauthenticated handshake phase but no prior authentication. Patches are available in MongoDB 7.0.40, 8.0.29, 8.2.13, 8.3.8, and later versions.
Affected products
- MongoDB MongoDB Server 7.0 before 7.0.40, 8.0 before 8.0.29, 8.2 before 8.2.13, 8.3 before 8.3.8, 9.0 before 9.0.0-rc2, 9.1 before 9.1.0-rc0
Timeline
- 2026-08-11: disclosed: CVE-2026-18691 published
- 2026-08-11: patched: Patches available in 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0