CVE-2026-5170

MEDIUM EPSS 10.4%
Published Mar 30, 20263mo ago · Modified Jun 17, 20262w ago
6.0 CVSS 4.0
Medium
Find Similar
Published Mar 30, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

CVSS Details

Base Score
6.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
10.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-617

Affected Products 3

VendorProductVersionRange
mongodbmongodb*≥7.0.0  –  <7.0.31
mongodbmongodb*≥8.0.0  –  <8.0.18
mongodbmongodb*≥8.2.0  –  <8.2.2

References 1

  • jira.mongodb.org https://jira.mongodb.org/browse/SERVER-101758
    PatchVendor Advisory

Remediation

  • jira.mongodb.org https://jira.mongodb.org/browse/SERVER-101758
    PatchVendor Advisory