MongoDB Server: unauthenticated use-after-free in replica set catch-up, crash or code exec (CVE-2026-118383)
Severity: critical · Patch status: patched · Since 2026-11-10 · CVE-2026-118383
MongoDB published CVE-2026-118383 on 2026-11-10, together with fixed releases on each branch from 4.4 to 9.0 that the vendor lists as affected. The bug is a use-after-free in the replication code that runs when a newly elected replica set primary finishes catching up on writes it missed. The vendor's CVE text says requests that need no authentication can reach it, and that the outcome is a server crash or, under certain conditions, arbitrary code execution. Datadog Security Labs reproduced the crash on 8.0.34 in a four-member lab: two unauthenticated ping requests carrying readConcern.afterOpTime left stale waiters on one member, and a failover that made that lagging member primary segfaulted it. The same two requests were rejected with Unauthorized on 8.0.37. The attacker cannot create the lag or the election, so the crash needs a member to fall behind and then win an election, which is why the CVSS attack complexity is High. Datadog did not demonstrate code execution. Standalone mongod is not affected. MongoDB said it was not aware of exploitation when it announced the fix, and the CISA KEV catalogue has no entry for this CVE. Fix: upgrade every replica set member, including shard and config server members and members offline during maintenance, to the fixed release for its branch, then confirm the running versions. Until then, limit network access to MongoDB to the systems that need it; that reduces who can send the requests but does not fix the bug. Atlas clusters are upgraded automatically during maintenance, according to MongoDB.
What to do
- Upgrade every replica set member (including shards, config servers, containers, and members offline during maintenance) to the fixed release for your branch and verify running versions
- Until upgraded, restrict network access to MongoDB to only the systems that need it
- Monitor MongoDB logs for COMMAND 'Slow query' events (ID 51803) with command.ping, readConcern.afterOpTime, and MaxTimeMSExpired/MaxTimeMSExpired errName indicating planted waiters
- If deferring maintenance (e.g. on Atlas), apply the upgrade promptly
Fixed versions
- 9.0.7
- 8.3.16
- 8.0.37
- 7.0.48
- 6.0.30
- 5.0.35
- 4.4.32
Sources
All live incidents on Threat Watch
