Disclosure summary
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact. This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.
Source-reported weakness categories
CWE-667
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-14345
Open original source · Updated Oct 07, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| mongodb | mongodb | * {"versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.2"} |
| mongodb | mongodb | 8.3.0 |
Original records & references
- NIST NVD record
- CVE Program record
- jira.mongodb.org — Vendor Advisory
PUBLISHED 2025-12-09T11:17:41-05:00
MODIFIED 2026-10-07T16:10:01-04:00
INGESTED 2026-10-08T12:35:36-04:00