# CVE-2026-18691: MongoDB Server SASL mechanism downgrade in intra-cluster authentication

Source: https://junglewise.ai/threats/cve-2026-18691-mongodb-server-sasl-mechanism-downgrade-in-intra-cluster  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18691 · Severity: high · CVSS 8.8 · Published 2026-08-11

MongoDB Server's internal communication between replica set members is vulnerable to downgrade attacks that could expose the cluster's shared internal credential. An attacker with network access can intercept the authentication handshake and trick a node into using weaker, less-protected authentication methods, potentially revealing the internal superuser password in cleartext. This credential could then be used to gain complete control over the entire database cluster.

Technologies: [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-18691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18691 being exploited in the wild.

**How severe is CVE-2026-18691?** High severity, with a CVSS score of 8.8, published 11 August 2026.

**Which products and versions are affected?** MongoDB Server 7.0 before 7.0.40, 8.0 before 8.0.29, 8.2 before 8.2.13, 8.3 before 8.3.8, 9.0 before 9.0.0-rc2, 9.1 before 9.1.0-rc0.

**Is there a fix for CVE-2026-18691?** A patch was published on 2026-08-11: Patches available in 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18691 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-18691?** Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a SASL mechanism downgrade vulnerability in MongoDB Server's intra-cluster connection setup. The root cause is that TLConnectionSetupHook::validateHost copies the saslSupportedMechs array from unauthenticated hello replies directly into _saslMechsForInternalAuth without validating against an allowlist, allowing an attacker to advertise only the PLAIN mechanism. When PLAIN is selected for internal authentication, getInternalAuthParams returns the raw keyfile string as a cleartext password. An attacker with network access (adjacent or network position) can forge a hello reply advertising only PLAIN to trigger transmission of the cluster's internal credential in cleartext. The vulnerability requires suitable network access to intercept and modify the unauthenticated handshake phase but no prior authentication. Patches are available in MongoDB 7.0.40, 8.0.29, 8.2.13, 8.3.8, and later versions.

## Affected products

- MongoDB MongoDB Server 7.0 before 7.0.40, 8.0 before 8.0.29, 8.2 before 8.2.13, 8.3 before 8.3.8, 9.0 before 9.0.0-rc2, 9.1 before 9.1.0-rc0

## Timeline

- 2026-08-11: disclosed: CVE-2026-18691 published
- 2026-08-11: patched: Patches available in 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0

## References

- [https://jira.mongodb.org/browse/SERVER-130264](https://jira.mongodb.org/browse/SERVER-130264)

## Related threats

- [MongoDB Server authorization bypass in aggregation pipeline](https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of)
- [MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of)
- [MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of)
- [MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource)
- [MongoDB Server use-after-free in aggregation framework](https://junglewise.ai/threats/cve-2026-120821-a-use-after-free-in-the-aggregation-framework-of-mongodb-server)