CVE-2026-18691 Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to ...

PT-2026-70848

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the intra-cluster connection setup allows an attacker with suitable network access to influence the authentication mechanism used during connections between replica set...

CVE-2026-18691: Selection of Less-Secure Algorithm During Negotiation

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to ...