At the bottom of s/config.cpp, in the replicaSetChange function, we get a ScopedDbConnection to the config servers using ScopedDbConnection::getScopedDbConnection. This should be ScopedDbConnection::getInternalScopedDbConnection.
This can prevent the config servers from being updated when a replica set configuration changes in an authenticated cluster.