CVE-2026-18691

The record

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.

Affected packages

Related vulnerabilities

• CVE-2026-20578 In Modem, there is a possible information disclosure due to side channel information… CWE-757
• CVE-2026-89177 WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of… CWE-757
• CVE-2026-59293 Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate… CWE-757
• CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature… CWE-757
• CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently… CWE-757
• CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher… CWE-757
• CVE-2026-4942 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted… CWE-757
• CVE-2026-53712 SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of… CWE-757