PT-2026-29047 · Mongodb · Mongodb Server+1

Published 2026-03-30 · Updated 2026-04-06 · CVE-2026-5170

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 8.2.2 MongoDB Server versions 8.0.18 through 8.0.18 MongoDB Server versions 7.0.31 through 7.0.31

Description A user with limited privileges within a cluster can cause a mongod process to crash when the cluster transitions from a replica set to a sharded cluster. This can lead to a denial of service by disrupting the primary replica set.

Recommendations Update MongoDB Server to version 8.2.2 or later. Update MongoDB Server to a version later than 8.0.18. Update MongoDB Server to a version later than 7.0.31.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BIT-MONGODB-2026-5170

CVE-2026-5170

Affected Products

Mongodb Server

Mongodb

References · 10

• https://jira.mongodb.org/browse/SERVER-101758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5170 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2026-5170 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5170 · Security Note
• https://ubuntu.com/security/CVE-2026-5170 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5170 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5170 · Note
• https://twitter.com/cyberbivash/status/2038650031633306105 · Twitter Post
• https://twitter.com/infoflowcloud/status/2039006751551332402 · Twitter Post
• https://twitter.com/CVEnew/status/2039004527412560041 · Twitter Post