Loading vulnerability…
Privilege Escalation in MongoDB Server Sharding Subsystem
An improper privilege management vulnerability in the MongoDB Server sharding subsystem allows an authenticated user with certain shard-level administrative privileges to trigger reprocessing of persisted internal coordination state with elevated internal authority. The state is trusted rather than revalidated against the user's authorized scope, allowing unauthorized operations, including changes to cluster-wide security configuration. Affected versions are 8.0.0 through versions before 8.0.37, 8.3.0 through versions before 8.3.16, and 9.0.0 through versions before 9.0.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can escalate shard-level administrative authority into unauthorized cluster-wide operations, compromising data confidentiality and integrity. An attacker can change cluster-wide security configuration and access or modify data across the cluster beyond the permissions assigned to their account.
Patch, then assume compromise.
Upgrade MongoDB Server to version 8.0.37, 8.3.16, or 9.0.7, or a later fixed release in the corresponding branch.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.