PT-2026-29047 · Mongodb+1 · Mongodb Server+2

CVE-2026-5170 · Publicado 2026-03-30 · Atualizado 2026-05-26

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Média

Vetor base

AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 8.2.2 MongoDB Server versions 8.0.18 through 8.0.18 MongoDB Server versions 7.0.31 through 7.0.31

Description A user with limited privileges within a cluster can cause a mongod process to crash when the cluster transitions from a replica set to a sharded cluster. This can lead to a denial of service by disrupting the primary replica set.

Recommendations Update MongoDB Server to version 8.2.2 or later. Update MongoDB Server to a version later than 8.0.18. Update MongoDB Server to a version later than 7.0.31.

Exploit

Correção

DoS

Assertion Failure

Enumeração de Fraquezas

CWE-617

Identificadores relacionados

BDU:2026-08419

BIT-MONGODB-2026-5170

CVE-2026-5170

Produtos afetados

Mongodb Server

Mongodb

Red Os

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5170.json · Exploit
• https://bdu.fstec.ru/vul/2026-08419 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-mongodb-org-cve-2026-5170-8.0 · Nota
• https://twitter.com/cyberbivash/status/2038650031633306105 · Publicação no Twitter
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-5170 · Nota
• https://ubuntu.com/security/CVE-2026-5170 · Aviso do Fabricante
• https://jira.mongodb.org/browse/SERVER-101758 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-5170 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-5170 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5170 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039004527412560041 · Publicação no Twitter
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mongodb-org-cve-2026-5170-7.3 · Nota
• https://github.com/advisories/GHSA-qg39-5q45-4gcc · Nota
• https://twitter.com/infoflowcloud/status/2039006751551332402 · Publicação no Twitter
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5170 · Nota