CVE-2025-14345: 
MongoDB vulnerability analysis and mitigation

CVE-2025-14345 is a post-authentication flaw in the network two-phase commit (2PC) protocol used for cross-shard transactions in MongoDB Server. Under specific, unpredictable, and transient conditions, the transaction coordination logic may misinterpret a transaction as committed, resulting in logical data inconsistencies across shards. Affected versions include MongoDB Server v7.0 prior to 7.0.26, v8.0 prior to 8.0.16, and v8.2 prior to 8.2.2. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Red Hat Advisory, MongoDB Jira).

The root cause is classified as CWE-667 (Improper Locking), where a race condition in the network two-phase commit protocol allows the transaction coordinator to reach an incorrect committed state under brief, non-deterministic timing windows. The flaw is exploitable over the network by an authenticated, low-privileged user — no user interaction is required — but exploitation requires specific attack preconditions (CVSS v4.0 Attack Requirements: Present), making reliable triggering difficult. The vulnerability is associated with CAPEC patterns for race condition exploitation (CAPEC-26: Leveraging Race Conditions) and forced deadlocks (CAPEC-25) (Red Hat Advisory, MongoDB Jira).

Successful exploitation can cause logical data inconsistencies across MongoDB shards in distributed (sharded cluster) deployments, leading to low integrity and low availability impact. Specifically, transaction state may be incorrectly recorded as committed on some shards while remaining uncommitted on others, potentially resulting in unexpected data state changes and disruptions to transaction consistency. There is no confidentiality impact, and the inconsistency window is transient and unpredictable, limiting but not eliminating the practical risk (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.033%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with low privileges and depends on specific, transient timing conditions that are not reliably reproducible (Red Hat Advisory, MongoDB Jira).

MongoDB has released patched versions addressing this vulnerability: upgrade to MongoDB Server v7.0.26, v8.0.16, or v8.2.2 as appropriate. In addition to patching, administrators should review and validate cross-shard transaction processes, implement strict access controls to limit low-privileged authentication, and monitor transaction logs for anomalous or inconsistent behavior. Temporary isolation of affected shards during the update window may be considered as a precautionary measure (MongoDB Jira, Red Hat Advisory).