CVE-2026-18709 — Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

CVE-2026-18709

Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency PUBLISHED

Description (CNA)

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.3.0 before 8.3.8; affected 8.0 before 8.0.29; affected 7.0 before 7.0.40

CWE

CWE-862

References

https://jira.mongodb.org/browse/SERVER-130544

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.