CVE-2025-14345 Details

A post-authentication vulnerability has been identified in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server. This flaw may cause logical data inconsistencies under specific, unpredictable conditions that last for a very short time. The issue arises when a transaction, initiated with the 'apiVersion' parameter, is left in a 'prepared' state on some shards after a failover event. The transaction coordination logic may then incorrectly interpret the situation as a successful commitment, leading to an inconsistent state across the affected shards. This vulnerability impacts MongoDB Server versions 8.0 prior to 8.0.16, 7.0 prior to 7.0.26, and 8.2 prior to 8.2.2.

Users can manually intervene to commit or abort blocked prepared transactions, if the transaction's commit or abort state can be determined from other shards or from the client. However, if definitive data is unavailable, recovery cannot be guaranteed.