Upgrade PSMDB 8.0.26-11 sem downtime

This post is also available in: English (Inglês)

A Percona publicou em 25/06/2026 a versão 8.0.26-11 do Percona Server for MongoDB com recomendação explícita de atualização urgente devido a múltiplas vulnerabilidades de alta severidade.

Este post documenta o upgrade realizado em lab: Replica Set de 3 nós no Oracle Linux 8, sem downtime para a aplicação.

Por que atualizar agora?

A versão 8.0.26-11 corrige 10 CVEs de severidade High e 1 Medium, todas afetando todas as versões 8.0.x anteriores.

CVEs corrigidas

CVE	Severidade	Impacto
CVE-2026-11933	High	Use-after-free no engine JS server-side (`$where`, `$function`) — information disclosure ou crash
CVE-2026-9740	High	BSON validator — DoS por input nao autenticado
CVE-2026-9743	High	Aggregation framework — DoS via cursor malicioso
CVE-2026-9753	High	`$_internalApplyOplogUpdate` — crash do servidor
CVE-2026-9752	High	Indice `2dsphere` — crash por documento crafted
CVE-2026-9750	High	Query execution — crash e resultados incorretos
CVE-2026-9749	High	`$exchange` stage — crash em key-range partitioning
CVE-2026-9748	High	`$_internalConvertBucketIndexStats` + `$facet` — crash
CVE-2026-9747	High	`fromRouter: true` + `runtimeConstants.userRoles` — crash
CVE-2026-9746	High	`$changeStream` + `$_requestReshardingResumeToken` — crash
CVE-2026-9751	Medium	`setParameter` logava credenciais em plaintext (ex: `ldapQueryPassword`)

⚠️ CVE-2026-9740 merece atencao especial: permite DoS por usuario nao autenticado via BSON validator. Qualquer porta mongod ou mongos exposta e um vetor de ataque imediato.

Alem das CVEs do servidor, os binarios mongodump/tools foram recompilados com golang.org/x/crypto v0.52.0 e golang.org/x/net v0.55.0, fechando 15 CVEs adicionais nas bibliotecas Go.

Ambiente do lab

Host	IP	Role
mongo-vm01	192.168.15.180	PRIMARY
mongo-vm02	192.168.15.181	SECONDARY
mongo-vm03	192.168.15.182	SECONDARY

OS: Oracle Linux 8
Replica Set: rs-source
Versao anterior: 8.0.23-10
Versao alvo: 8.0.26-11

Tem downtime?

Nao, desde que a connection string da aplicacao use retryWrites=true:

mongodb://host1,host2,host3/?replicaSet=rs-source&retryWrites=true

mongodb://host1,host2,host3/?replicaSet=rs-source&retryWrites=true

O rolling upgrade mantem o cluster operacional durante todo o processo. O unico impacto e ~5-15 segundos sem writes durante a eleicao do novo primario — drivers modernos absorvem isso automaticamente com retry.

Pre-checagem (obrigatoria)

1. Validar estado do cluster

mongosh --quiet --eval '
rs.status().members.forEach(m => print(m.name + " | " + m.stateStr + " | health=" + m.health));
print("---");
print("Version: " + db.version());
print("fCV: " + JSON.stringify(db.adminCommand({getParameter:1, featureCompatibilityVersion:1}).featureCompatibilityVersion));
'

mongosh --quiet --eval '
rs.status().members.forEach(m => print(m.name + " | " + m.stateStr + " | health=" + m.health));
print("---");
print("Version: " + db.version());
print("fCV: " + JSON.stringify(db.adminCommand({getParameter:1, featureCompatibilityVersion:1}).featureCompatibilityVersion));
'

Output obtido:

192.168.15.180:27017 | PRIMARY | health=1
192.168.15.181:27017 | SECONDARY | health=1
192.168.15.182:27017 | SECONDARY | health=1
---
Version: 8.0.23-10
fCV: {"version":"8.0"}

192.168.15.180:27017 | PRIMARY | health=1
192.168.15.181:27017 | SECONDARY | health=1
192.168.15.182:27017 | SECONDARY | health=1
---
Version: 8.0.23-10
fCV: {"version":"8.0"}

✅ 3 nos saudaveis, fCV 8.0 — pode prosseguir.

2. Validar repositorio e pacote disponivel

Execute em cada no:

sudo dnf clean all && sudo dnf makecache
sudo dnf --showduplicates list percona-server-mongodb 2>/dev/null | grep 8.0.26

sudo dnf clean all && sudo dnf makecache
sudo dnf --showduplicates list percona-server-mongodb 2>/dev/null | grep 8.0.26

Output esperado:

percona-server-mongodb.x86_64    8.0.26-11.el8    psmdb-80-release-x86_64

percona-server-mongodb.x86_64    8.0.26-11.el8    psmdb-80-release-x86_64

3. Validar pacotes instalados

rpm -qa | grep -i percona-server-mongodb | sort

rpm -qa | grep -i percona-server-mongodb | sort

Output obtido:

percona-server-mongodb-8.0.23-10.el8.x86_64
percona-server-mongodb-mongos-8.0.23-10.el8.x86_64
percona-server-mongodb-server-8.0.23-10.el8.x86_64
percona-server-mongodb-tools-8.0.23-10.el8.x86_64

percona-server-mongodb-8.0.23-10.el8.x86_64
percona-server-mongodb-mongos-8.0.23-10.el8.x86_64
percona-server-mongodb-server-8.0.23-10.el8.x86_64
percona-server-mongodb-tools-8.0.23-10.el8.x86_64

Obtencao dos pacotes

Opcao A — Download via repositorio Percona (host com acesso a internet)

sudo dnf install -y dnf-plugins-core

mkdir -p /tmp/psmdb-8.0.26-11

sudo dnf download \
  --releasever=8 \
  --arch=x86_64 \
  --destdir=/tmp/psmdb-8.0.26-11 \
  percona-server-mongodb-8.0.26-11.el8 \
  percona-server-mongodb-server-8.0.26-11.el8 \
  percona-server-mongodb-mongos-8.0.26-11.el8 \
  percona-server-mongodb-tools-8.0.26-11.el8

sudo dnf install -y dnf-plugins-core

mkdir -p /tmp/psmdb-8.0.26-11

sudo dnf download \
  --releasever=8 \
  --arch=x86_64 \
  --destdir=/tmp/psmdb-8.0.26-11 \
  percona-server-mongodb-8.0.26-11.el8 \
  percona-server-mongodb-server-8.0.26-11.el8 \
  percona-server-mongodb-mongos-8.0.26-11.el8 \
  percona-server-mongodb-tools-8.0.26-11.el8

Opcao B — Download no Windows e transferencia para Linux

Para ambientes sem acesso direto a internet nos servidores Linux.

Download via PowerShell:

$base = "https://downloads.percona.com/downloads/percona-server-mongodb-8.0/percona-server-mongodb-8.0.26-11/binary/redhat/8/x86_64"
$dest = "C:\tmp\psmdb-8.0.26-11"
New-Item -ItemType Directory -Force -Path $dest

@(
  "percona-server-mongodb-8.0.26-11.el8.x86_64.rpm",
  "percona-server-mongodb-server-8.0.26-11.el8.x86_64.rpm",
  "percona-server-mongodb-mongos-8.0.26-11.el8.x86_64.rpm",
  "percona-server-mongodb-tools-8.0.26-11.el8.x86_64.rpm"
) | ForEach-Object {
  Invoke-WebRequest -Uri "$base/$_" -OutFile "$dest\$_"
  Write-Host "Downloaded: $_"
}

$base = "https://downloads.percona.com/downloads/percona-server-mongodb-8.0/percona-server-mongodb-8.0.26-11/binary/redhat/8/x86_64"
$dest = "C:\tmp\psmdb-8.0.26-11"
New-Item -ItemType Directory -Force -Path $dest

@(
  "percona-server-mongodb-8.0.26-11.el8.x86_64.rpm",
  "percona-server-mongodb-server-8.0.26-11.el8.x86_64.rpm",
  "percona-server-mongodb-mongos-8.0.26-11.el8.x86_64.rpm",
  "percona-server-mongodb-tools-8.0.26-11.el8.x86_64.rpm"
) | ForEach-Object {
  Invoke-WebRequest -Uri "$base/$_" -OutFile "$dest\$_"
  Write-Host "Downloaded: $_"
}

Transferencia via SCP:

$dest = "C:\tmp\psmdb-8.0.26-11"
$hosts = @("192.168.15.180", "192.168.15.181", "192.168.15.182")

foreach ($h in $hosts) {
  ssh root@$h "mkdir -p /tmp/psmdb-8.0.26-11"
  scp "$dest\*.rpm" "root@${h}:/tmp/psmdb-8.0.26-11/"
  Write-Host "Transferido para $h"
}

$dest = "C:\tmp\psmdb-8.0.26-11"
$hosts = @("192.168.15.180", "192.168.15.181", "192.168.15.182")

foreach ($h in $hosts) {
  ssh root@$h "mkdir -p /tmp/psmdb-8.0.26-11"
  scp "$dest\*.rpm" "root@${h}:/tmp/psmdb-8.0.26-11/"
  Write-Host "Transferido para $h"
}

Validacao dos pacotes (obrigatoria)

for f in /tmp/psmdb-8.0.26-11/*.rpm; do
  echo "=== $(basename $f) ==="
  rpm -K "$f"
done

for f in /tmp/psmdb-8.0.26-11/*.rpm; do
  echo "=== $(basename $f) ==="
  rpm -K "$f"
done

Output obtido:

=== percona-server-mongodb-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-8.0.26-11.el8.x86_64.rpm: digests signatures OK
=== percona-server-mongodb-mongos-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-mongos-8.0.26-11.el8.x86_64.rpm: digests signatures OK
=== percona-server-mongodb-server-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-server-8.0.26-11.el8.x86_64.rpm: digests signatures OK
=== percona-server-mongodb-tools-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-tools-8.0.26-11.el8.x86_64.rpm: digests signatures OK

=== percona-server-mongodb-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-8.0.26-11.el8.x86_64.rpm: digests signatures OK
=== percona-server-mongodb-mongos-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-mongos-8.0.26-11.el8.x86_64.rpm: digests signatures OK
=== percona-server-mongodb-server-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-server-8.0.26-11.el8.x86_64.rpm: digests signatures OK
=== percona-server-mongodb-tools-8.0.26-11.el8.x86_64.rpm ===
/tmp/psmdb-8.0.26-11/percona-server-mongodb-tools-8.0.26-11.el8.x86_64.rpm: digests signatures OK

Se aparecer NOKEY, importe a chave GPG: “bash sudo rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY “

Dry-run (simula sem instalar)

sudo dnf install --assumeno /tmp/psmdb-8.0.26-11/*.rpm

sudo dnf install --assumeno /tmp/psmdb-8.0.26-11/*.rpm

Output esperado:

Upgrading:
 percona-server-mongodb          x86_64  8.0.26-11.el8  @commandline   8.2 k
 percona-server-mongodb-mongos   x86_64  8.0.26-11.el8  @commandline    32 M
 percona-server-mongodb-server   x86_64  8.0.26-11.el8  @commandline    70 M
 percona-server-mongodb-tools    x86_64  8.0.26-11.el8  @commandline    33 M

Upgrade  4 Packages
Operation aborted.

Upgrading:
 percona-server-mongodb          x86_64  8.0.26-11.el8  @commandline   8.2 k
 percona-server-mongodb-mongos   x86_64  8.0.26-11.el8  @commandline    32 M
 percona-server-mongodb-server   x86_64  8.0.26-11.el8  @commandline    70 M
 percona-server-mongodb-tools    x86_64  8.0.26-11.el8  @commandline    33 M

Upgrade  4 Packages
Operation aborted.

✅ Apenas Upgrading — nenhum Installing de pacote novo, nenhum Removing. “Operation aborted” e o comportamento esperado do --assumeno.

Rolling Upgrade — um no por vez

Ordem de execucao:

1. mongo-vm03 (192.168.15.182) -- SECONDARY
2. mongo-vm02 (192.168.15.181) -- SECONDARY
3. mongo-vm01 (192.168.15.180) -- PRIMARY (stepDown antes)

1. mongo-vm03 (192.168.15.182) -- SECONDARY
2. mongo-vm02 (192.168.15.181) -- SECONDARY
3. mongo-vm01 (192.168.15.180) -- PRIMARY (stepDown antes)

No 1 — mongo-vm03 (SECONDARY)

mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

sudo systemctl stop mongod

sudo dnf install -y /tmp/psmdb-8.0.26-11/*.rpm

/usr/bin/mongod --version && \
sudo systemctl start mongod && \
sleep 5 && \
mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

sudo systemctl stop mongod

sudo dnf install -y /tmp/psmdb-8.0.26-11/*.rpm

/usr/bin/mongod --version && \
sudo systemctl start mongod && \
sleep 5 && \
mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

Output obtido:

db version v8.0.26-11
...
SECONDARY

db version v8.0.26-11
...
SECONDARY

Validar lag de replicacao:

mongosh --quiet --eval "rs.printSecondaryReplicationInfo()"

mongosh --quiet --eval "rs.printSecondaryReplicationInfo()"

source: 192.168.15.182:27017
  replLag: '-10 secs (0 hrs) behind the primary'

source: 192.168.15.182:27017
  replLag: '-10 secs (0 hrs) behind the primary'

✅ Lag zero (valor negativo e normal — no ligeiramente a frente do snapshot do primario).

No 2 — mongo-vm02 (SECONDARY)

Mesma sequencia do no anterior:

mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

sudo systemctl stop mongod
sudo dnf install -y /tmp/psmdb-8.0.26-11/*.rpm
/usr/bin/mongod --version && sudo systemctl start mongod && sleep 5 && \
mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

sudo systemctl stop mongod
sudo dnf install -y /tmp/psmdb-8.0.26-11/*.rpm
/usr/bin/mongod --version && sudo systemctl start mongod && sleep 5 && \
mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

Output obtido:

db version v8.0.26-11
...
SECONDARY

db version v8.0.26-11
...
SECONDARY

mongosh --quiet --eval "rs.printSecondaryReplicationInfo()"

mongosh --quiet --eval "rs.printSecondaryReplicationInfo()"

source: 192.168.15.181:27017
  replLag: '0 secs (0 hrs) behind the primary'
source: 192.168.15.182:27017
  replLag: '0 secs (0 hrs) behind the primary'

source: 192.168.15.181:27017
  replLag: '0 secs (0 hrs) behind the primary'
source: 192.168.15.182:27017
  replLag: '0 secs (0 hrs) behind the primary'

✅ Ambos os secundarios em 8.0.26-11 com lag zero.

No 3 — mongo-vm01 (PRIMARY)

⚠️ Nao pare o primario diretamente. Faca o stepDown primeiro para garantir eleicao limpa.

StepDown:

mongosh --quiet --eval "db.adminCommand({ replSetStepDown: 60, secondaryCatchUpPeriodSecs: 30 })"

mongosh --quiet --eval "db.adminCommand({ replSetStepDown: 60, secondaryCatchUpPeriodSecs: 30 })"

Output obtido:

{ ok: 1 }

{ ok: 1 }

Confirmar nova topologia:

mongosh --quiet --eval "rs.status().members.forEach(m => print(m.name + ' | ' + m.stateStr))"

mongosh --quiet --eval "rs.status().members.forEach(m => print(m.name + ' | ' + m.stateStr))"

192.168.15.180:27017 | SECONDARY
192.168.15.181:27017 | PRIMARY
192.168.15.182:27017 | SECONDARY

192.168.15.180:27017 | SECONDARY
192.168.15.181:27017 | PRIMARY
192.168.15.182:27017 | SECONDARY

✅ mongo-vm01 virou SECONDARY. mongo-vm02 assumiu como PRIMARY.

Parar, instalar, subir:

sudo systemctl stop mongod
sudo dnf install -y /tmp/psmdb-8.0.26-11/*.rpm
/usr/bin/mongod --version && sudo systemctl start mongod && sleep 5 && \
mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

sudo systemctl stop mongod
sudo dnf install -y /tmp/psmdb-8.0.26-11/*.rpm
/usr/bin/mongod --version && sudo systemctl start mongod && sleep 5 && \
mongosh --quiet --eval "rs.status().members.find(m => m.self).stateStr"

Output obtido:

db version v8.0.26-11
...
SECONDARY

db version v8.0.26-11
...
SECONDARY

Validacao final

mongosh --quiet --eval '
rs.status().members.forEach(m => print(m.name + " | " + m.stateStr));
print("---");
db.adminCommand({getParameter:1, featureCompatibilityVersion:1}).featureCompatibilityVersion;
rs.printSecondaryReplicationInfo();
'

mongosh --quiet --eval '
rs.status().members.forEach(m => print(m.name + " | " + m.stateStr));
print("---");
db.adminCommand({getParameter:1, featureCompatibilityVersion:1}).featureCompatibilityVersion;
rs.printSecondaryReplicationInfo();
'

Output obtido:

192.168.15.180:27017 | PRIMARY
192.168.15.181:27017 | SECONDARY
192.168.15.182:27017 | SECONDARY
---
{ version: '8.0' }
source: 192.168.15.181:27017
  replLag: '0 secs (0 hrs) behind the primary'
source: 192.168.15.182:27017
  replLag: '0 secs (0 hrs) behind the primary'

192.168.15.180:27017 | PRIMARY
192.168.15.181:27017 | SECONDARY
192.168.15.182:27017 | SECONDARY
---
{ version: '8.0' }
source: 192.168.15.181:27017
  replLag: '0 secs (0 hrs) behind the primary'
source: 192.168.15.182:27017
  replLag: '0 secs (0 hrs) behind the primary'

✅ Cluster 100% saudavel na versao 8.0.26-11.

Nota: mongo-vm01 voltou a ser PRIMARY via eleicao apos o startup — comportamento esperado, pois possui maior prioridade configurada no replica set.

Resumo

No	IP	Versao anterior	Versao atual
mongo-vm03	192.168.15.182	8.0.23-10	8.0.26-11
mongo-vm02	192.168.15.181	8.0.23-10	8.0.26-11
mongo-vm01	192.168.15.180	8.0.23-10	8.0.26-11

Downtime efetivo: ~5-10s durante eleicao do primario
fCV: mantida em 8.0 — nenhuma acao necessaria
CVEs fechadas: 10 high + 1 medium no servidor; 15 CVEs Go nos tools

Search

Upgrade Percona Server for MongoDB 8.0.23-10 para 8.0.26-11

Clonar Usuário MongoDB Preservando a Senha

ORA-06553: DBCA Falha no catalog.sql com PLS-213

Upgrade Percona Server for MongoDB 8.0.23-10 para 8.0.26-11

INS-06006 – Passwordless SSH Connectivity Not Set Up

Limpeza da biblioteca de software OEM: Purge seguro e controle de crescimento de swlib

ORA-29548 – Como corrigir o erro “Java System Class Reported” no Oracle Database

Search

Upgrade Percona Server for MongoDB 8.0.23-10 para 8.0.26-11

Clonar Usuário MongoDB Preservando a Senha

ORA-06553: DBCA Falha no catalog.sql com PLS-213

Upgrade Percona Server for MongoDB 8.0.23-10 para 8.0.26-11

Por que atualizar agora?

CVEs corrigidas

Ambiente do lab

Tem downtime?

Pre-checagem (obrigatoria)

1. Validar estado do cluster

2. Validar repositorio e pacote disponivel

3. Validar pacotes instalados

Obtencao dos pacotes

Opcao A — Download via repositorio Percona (host com acesso a internet)

Opcao B — Download no Windows e transferencia para Linux

Validacao dos pacotes (obrigatoria)

Dry-run (simula sem instalar)

Rolling Upgrade — um no por vez

No 1 — mongo-vm03 (SECONDARY)

No 2 — mongo-vm02 (SECONDARY)

No 3 — mongo-vm01 (PRIMARY)

Validacao final

Resumo

Referencias

INS-06006 – Passwordless SSH Connectivity Not Set Up

Limpeza da biblioteca de software OEM: Purge seguro e controle de crescimento de swlib

ORA-29548 – Como corrigir o erro “Java System Class Reported” no Oracle Database