CVE-2026-5170CWE-617

Users could trigger a crash of mongod primaries during promotion to sharded

Medium · published March 30, 2026

CVSS v4.0

6.0

EPSS

Percentile

25.6

In the wild

Unconfirmed

What it is

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set.

This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

The record

Technical detail

CVSS v4.0: 6.0 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00335 · 25.6th percentile
Weakness: CWE-617 · Reachable Assertion
Published: 2026-03-30T15:28Z

EPSS history

Timeline

30 MAR 15:28Z
Users could trigger a crash of mongod primaries during promotion to sharded
cvelistv5