{
  "cveId": "CVE-2026-18691",
  "url": "https://patchblox.com/security/cve/CVE-2026-18691",
  "summary": "CVE-2026-18691 is fixed in MongoDB on 1 platform by MongoDB 8.3.11 (version 8.3.11), released September 9, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure",
  "description": "An issue in MongoDB Server\u0027s intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster\u0027s shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.",
  "published": "2026-08-11T19:17:22Z",
  "severity": "",
  "cvss": 9,
  "cwe": "CWE-757: Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
  "epss": 0.00355,
  "epssPercentile": 0.29475,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-18691",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "MongoDB",
      "fixedVersion": "8.3.11",
      "fix": "MongoDB 8.3.11",
      "url": "https://patchblox.com/security/fix/windows-app/mongodb.server-8.3.11",
      "released": "2026-09-09T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}