Skip to main content

MongoDB System Alert: Read/Write concern not honored on direct shard connections that bypass mongos (SERVER-111031)

Written by Clevyyy

Description

  • Date announced: May 14, 2026

  • Impact: When connecting directly to shard nodes instead of through mongos (including during a replica set promotion to sharded cluster), cluster-wide default read/write concerns may not be honored, causing writes to use {w: 1} instead of configured concerns, potentially losing acknowledged writes if rollback occurs.

  • MongoDB Versions: Any direct shard operations without explicit read/write concerns are affected on the following MongoDB versions:

    • 5.0.0 - 5.0.32

    • 6.0.0 - 6.0.28

    • 7.0.0 - 7.0.31

    • 8.0.0 - 8.0.19

    • 8.2.0 - 8.2.3

Details

We have identified an issue affecting MongoDB sharded clusters on versions 5.0 through 8.2 that causes default read and write concerns to not be honored when operations bypass mongos and are sent directly to shard nodes. In those instances, direct shard operations use {w: 1} and {level: "local"}, potentially losing acknowledged writes if rollback occurs or causing inconsistent reads.

This issue can only manifest if all the following are true:

  • You have a sharded cluster or you are promoting a replica set to a sharded cluster;

  • Your application sends operations directly to a shard, bypassing mongos; and

  • Your application does not attach an explicit read/write concern to each operation

The latest patch versions of MongoDB contain fixes for this issue.

Action Items

For MongoDB Atlas Customers: Your Atlas clusters have already been upgraded to versions containing fixes for this issue as part of our proactive response for CVE-2026-8053. Please note that the issue described in this critical advisory is unrelated to the CVE; we simply delivered these fixes together to prevent the need for an additional upgrade.

We recommend:

  • Before promoting a replica set to a sharded cluster

    • Upgrade to the latest MongoDB patch version

    • If upgrading is not immediately possible, take one of the following precautions for future promotions:

      • Specify explicit read and write concerns (for example, {w: "majority"}) in your connection string, or

      • Stop all application traffic before beginning the promotion

  • After promotion

    • Update your application connection string to use mongos

    • Restart your application to ensure it connects through mongos

For more information, see SERVER-111031. If you have any questions, open a support case (if you have an active support plan) or start a chat with the Atlas Support team.

Did this answer your question?