CVE-2026-5170 MEDIUM

CVE-2026-5170: Users could trigger a crash of mongod primaries during promotion to sharded

Vendor Mongodb
Product MongoDB Server
Weakness CWE-617
Published March 30, 2026
Last update March 30, 2026
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

Key dates

02Disclosure timeline

March 30, 2026 CVE published
March 30, 2026 Record updated