CVE-2025-14345: MongoDB Server Race Condition Vulnerability

CVE-2025-14345 Overview

CVE-2025-14345 is a post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server. Under narrow and non-deterministic conditions, the transaction coordination logic can misinterpret a transaction as committed. This produces inconsistent state across the participating shards.

The issue affects MongoDB Server v8.0 before 8.0.16, v7.0 before 7.0.26, and v8.2 before 8.2.2. The flaw requires authenticated access and high attack complexity, limiting practical exploitation. The impact is confined to low integrity and availability effects on affected shards.

Critical Impact
Authenticated clients issuing cross-shard transactions may trigger logical data inconsistencies when the two-phase commit coordinator misinterprets transaction state.

Affected Products

MongoDB Server v8.0 versions prior to 8.0.16
MongoDB Server v7.0 versions prior to 7.0.26
MongoDB Server v8.2 versions prior to 8.2.2

Discovery Timeline

2025-12-09 - CVE-2025-14345 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14345

Vulnerability Analysis

MongoDB uses a distributed two-phase commit (2PC) protocol to coordinate transactions that span multiple shards. A transaction coordinator sends a prepare phase to each participating shard, collects votes, and then issues a commit or abort decision. The protocol depends on correct interpretation of network responses to determine the final transaction state.

This vulnerability stems from improper locking or synchronization behavior in the coordinator logic, classified under [CWE-667] Improper Locking. Under specific transient network conditions, the coordinator can incorrectly interpret the transaction as committed when it should not be. The affected shards then persist state as if the transaction succeeded.

The result is a logical data inconsistency across shards. Integrity impact is limited because only data within scoped cross-shard transactions is affected. Availability impact is possible when downstream operations depend on consistent cross-shard state.

Root Cause

The root cause lies in the network two-phase commit protocol's handling of transaction coordination under specific, short-lived timing conditions. The coordinator misclassifies a transaction's final outcome, violating the atomicity guarantee that 2PC is designed to provide. See MongoDB Issue SERVER-106075 for vendor details.

Attack Vector

Exploitation requires network access and valid low-privilege MongoDB credentials. The attacker must also trigger the narrow timing window during cross-shard transaction coordination, which the vendor describes as unpredictable and short-lived. No public proof-of-concept exploit exists, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.216%.

No verified exploitation code is available. Refer to the vendor advisory for additional technical context.

Detection Methods for CVE-2025-14345

Indicators of Compromise

Unexplained logical inconsistencies between documents across sharded collections after cross-shard transactions.
Coordinator log entries showing anomalous commit decisions or state transitions in config.transaction_coordinators.
Application-level integrity check failures following distributed write operations.

Detection Strategies

Audit MongoDB Server version banners across replica sets and shards to identify instances running versions prior to 8.0.16, 7.0.26, or 8.2.2.
Enable and review MongoDB diagnostic logs for two-phase commit coordinator warnings, aborted transactions, and retry patterns.
Run periodic data reconciliation jobs that validate referential integrity between shards for critical collections.

Monitoring Recommendations

Monitor the transactions and shardingStatistics server status metrics for abnormal commit, abort, or retry rates.
Alert on authentication events from unexpected principals performing cross-shard transactions.
Centralize MongoDB audit logs into a SIEM for correlation with application-tier integrity errors.

How to Mitigate CVE-2025-14345

Immediate Actions Required

Upgrade MongoDB Server to 8.0.16, 7.0.26, 8.2.2, or later as appropriate for your deployment track.
Enforce least-privilege role-based access control to limit which authenticated users can issue cross-shard transactions.
Review recent cross-shard transaction activity for logical inconsistencies and reconcile affected data.

Patch Information

MongoDB has released fixed versions 8.0.16, 7.0.26, and 8.2.2. Deployment and remediation details are tracked in MongoDB Issue SERVER-106075. Operators should plan rolling upgrades across configuration servers, shards, and mongos routers.

Workarounds

Restrict transactional workloads that span multiple shards until the patched version is deployed.
Design application-level idempotency and reconciliation checks for distributed write paths.
Limit MongoDB network exposure using firewall rules and TLS mutual authentication to reduce the authenticated attack surface.

bash

# Verify running MongoDB Server version
mongosh --quiet --eval 'db.version()'

# Check for cross-shard transaction coordinator state
mongosh --quiet --eval 'use config; db.transaction_coordinators.find().pretty()'