An algorithm downgrade vulnerability in MongoDB intra-cluster communication allows a network-adjacent attacker to force the use of weaker authentication mechanisms, endangering cluster security.

This is an algorithm downgrade vulnerability (CWE-757) occurring during intra-cluster connection setup. It allows an attacker with network access to influence the authentication negotiation process between replica set members.

Successful exploitation could permit an attacker to downgrade the security of cluster communications, potentially facilitating unauthorized access to data or control of the database infrastructure. With a CVSS score of 8.8, this flaw represents a significant risk to the confidentiality and integrity of distributed database clusters.

Immediate Action: Apply the vendor-provided security updates to the MongoDB Server versions 8.3.8, 8.0.29, or 7.0.40 as applicable to your environment.

Proactive Monitoring: Monitor intra-cluster traffic for anomalous connection attempts or authentication failures that may indicate an attempt to influence negotiation.

Compensating Controls: Ensure that network segmentation is strictly enforced to limit access to the internal cluster communication ports to authorized replica set members only.

Public Exploit Available: No (unknown)

This vulnerability impacts the foundational security of MongoDB clusters. Administrators should prioritize patching their database instances to the specified fixed versions to ensure the integrity of authentication negotiations across the cluster.