CVE-2026-5170: 
MongoDB vulnerability analysis and mitigation

CVE-2026-5170 is a Reachable Assertion (CWE-617) vulnerability in MongoDB Server that allows a low-privileged authenticated user to crash the mongod process during the narrow window when a cluster is being promoted from a replica set to a sharded cluster, resulting in a denial of service. It affects MongoDB Server v7.0 prior to 7.0.31, v8.0 prior to 8.0.18, and v8.2 prior to 8.2.2. The vulnerability was published on March 30, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, MongoDB Jira).

The root cause is a reachable assertion (CWE-617) within the mongod process that can be triggered during the cluster promotion phase — specifically when a replica set is being converted to a sharded cluster. An attacker with network access and a limited set of cluster privilege actions can send a crafted operation during this transient, unpredictable window to hit the assertion, causing the process to exit abnormally. The high attack complexity reflects the timing dependency: exploitation requires the attacker to act precisely during the promotion window, which is not continuously available. No public proof-of-concept or detailed technical write-up has been identified (GitHub Advisory, MongoDB Jira).

Successful exploitation causes the mongod process to crash, taking down the primary node of the replica set and resulting in a denial of service. There is no confidentiality or integrity impact — data is not exposed or modified. Depending on replica set configuration and failover speed, this could cause temporary or sustained service unavailability for applications dependent on the MongoDB primary (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires an authenticated user with at least low-level cluster privileges and precise timing during the replica set-to-sharded-cluster promotion window, which significantly limits opportunistic exploitation. The EPSS score is approximately 0.039% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

MongoDB has released patched versions addressing this vulnerability: upgrade to MongoDB Server 7.0.31 or later, 8.0.18 or later, or 8.2.2 or later. As a compensating control, restrict cluster access to only trusted users and apply the principle of least privilege to minimize the number of accounts with cluster modification capabilities. Additionally, monitor for unusual activity or unexpected mongod process crashes during replica set to sharded cluster promotion operations (GitHub Advisory, MongoDB Jira, IBM Advisory).

IBM issued a security advisory noting that IBM Cloud Pak for AIOps is affected by this vulnerability, indicating downstream impact on enterprise products that bundle MongoDB (IBM Advisory). No significant researcher commentary or broad social media discussion has been identified for this vulnerability.