MongoDB has fixed a critical flaw in MongoDB Server that a client without credentials can trigger. MongoDB’s alert for CVE-2026-118383, dated 10 November, describes a “pre-authentication use-after-free in MongoDB Server replica set primary catch-up” and rates it 9.5 on the CVSS 4.0 scale. The Hacker News reports that MongoDB found the flaw itself and is not aware of exploitation attempts.
What triggers it
Datadog Security Labs reproduced it. Two ping commands carrying a readConcern.afterOpTime value leave pending “waiters” on a replica set member. They do not expire. If that member later wins an election while it is behind, the cleanup at the end of catch-up runs twice on freed memory and the new primary crashes before it accepts writes. “Turning on authentication does not prevent this,” Datadog writes.
The attacker cannot make the member fall behind or win the election on their own. Datadog forced those conditions in a lab with admin access. On 8.0.34 the member crashed with a segmentation fault and the lab cluster was left without a primary. On the fixed 8.0.37 both requests were rejected as unauthorized. MongoDB lists arbitrary code execution as a possible impact under certain conditions. Datadog says its tests did not achieve it.
Who is affected
Replica set members, including shard and config server members of sharded clusters. A standalone mongod is not affected, according to Datadog and The Hacker News.
Fixed releases, from MongoDB’s alert:
| Branch | Fixed in |
|---|---|
| 9.0 | 9.0.7 |
| 8.3 | 8.3.16 |
| 8.0 | 8.0.37 |
| 7.0 | 7.0.48 |
| 6.0 | 6.0.30 |
| 5.0 | 5.0.35 |
| 4.4 | 4.4.32 |
The 8.2 branch is not in the list. It reached end of life on 31 July, per MongoDB’s lifecycle schedule, so it no longer gets fixes. The Hacker News notes a public proof of concept reporting that 8.2.12 still showed the bug in a lab test. If you are on 8.2, move to a supported branch.
The Hacker News, citing MongoDB’s security announcement, reports that Atlas clusters receive the fix during maintenance, and customers who defer maintenance should apply it soon.
What to do
- Upgrade every member of each replica set, then check the version each member actually runs, including containers and members that were offline.
- Until then, limit network access to the database to the hosts that need it. Datadog notes this narrows who can send the requests but does not fix the flaw.
Earlier this autumn ClickHouse had its own critical unauthenticated flaw, and MongoDB’s Atlas Agent Engine preview shows how much agent state is moving onto MongoDB.
Why this matters
Plenty of RAG and agent stacks keep documents, memory and session state in self-managed MongoDB replica sets. This bug needs no credentials, and a crash during failover hits exactly when the cluster is already under stress. Treat it as a patch-this-week item, and inventory any 8.2 deployments, which will not get a fix.
The Campfire
CommentsThanks. Your comment is waiting for the desk. Once it is approved it appears here within about a minute.
Add a comment