A user with limited cluster privileges can trigger a crash of a mongod process during the brief, unpredictable window that occurs while a replica set is promoted to a sharded cluster. This vulnerability, identified as CWE‑617, results in the loss of the primary node and causes a denial of service against the affected database. The impact is limited to availability; confidentiality and integrity are not directly affected.

MongoDB Server is affected in the following versions: all v8.2 releases before 8.2.2, v8.0 releases from 8.0.18 onward, and v7.0 releases starting with 7.0.31. Users running any of these versions during a promotion operation are at risk.

The CVSS score of 6.0 indicates moderate severity, while the EPSS score of less than 1% shows that the likelihood of real‑world exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have at least a limited set of privilege actions within the cluster and to act during the narrow promotion window, making the attack surface relatively constrained. Nevertheless, if exploited, the attacker can cause a temporary outage of the primary node and disrupt cluster operations.