CVE-2026-5170
Last modified
CVE-2026-5170 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.
Metrics
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Mongodb | >= 7.0.0, < 7.0.31 |
| Mongodb | Mongodb | >= 8.0.0, < 8.0.18 |
| Mongodb | Mongodb | >= 8.2.0, < 8.2.2 |
References
- https://jira.mongodb.org/browse/SERVER-101758Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-5170?
How severe is CVE-2026-5170?
How do I fix CVE-2026-5170?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-5163Mattermost versions 11.5.x <= 11.5.1 fail to verify channel …6.5
- CVE-2026-5164A flaw was found in virtio-win. The `RhelDoUnMap()` function…5.5
- CVE-2026-5165A flaw was found in virtio-win, specifically within the Virt…7.8
- CVE-2026-5166Improper Limitation of a Pathname to a Restricted Directory …9.6
- CVE-2026-5167The Masteriyo LMS – Online Course Builder for eLearning, LMS…5.3
- CVE-2026-5169The Inquiry Form to Posts or Pages plugin for WordPress is v…4.4
- CVE-2026-5171Improper access control in the entry activity log feature in…4.3
- CVE-2026-5172A buffer overflow in dnsmasq’s extract_addresses() function …7.3
- CVE-2026-5173GitLab has remediated an issue in GitLab CE/EE affecting all…8.5
- CVE-2026-5174Improper input validation vulnerability in Progress Software…8.8
- CVE-2026-5175Improper access control in the multi-factor authentication (…5
- CVE-2026-5176A security flaw has been discovered in Totolink A3300R 17.0.…9.8
Are you affected by CVE-2026-5170?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST