CVE-2026-118383

Critical Pre-Auth MongoDB Flaw CVE-2026-118383 Can Crash Lagging Servers on Failover

A critical use-after-free vulnerability in MongoDB Server, tracked as CVE-2026-118383, allows an unauthenticated attacker to send two specially crafted ping requests that plant persistent waiters on a replica set member. The flaw only triggers when that lagging member later wins an election and completes its catch-up phase, causing the server to reuse freed memory and crash with a segmentation fault. MongoDB rated the issue 9.5 on CVSS 4.0 and released fixes across affected branches earlier this week, while confirming it discovered the bug internally and has seen no exploitation in the wild. The vulnerability affects replica set members, including shard and config servers in sharded clusters, but does not impact standalone mongod instances or the 8.2 branch. Researchers at Datadog Security Labs reproduced the crash in a lab environment and published a proof-of-concept that demonstrates reliable reproduction only under test-only settings. MongoDB Atlas clusters receive automatic patches during maintenance windows, while self-managed deployments must apply the fixed releases to every replica set member. The company also noted that the flaw could theoretically lead to arbitrary code execution under certain conditions, although the researchers did not achieve code execution in testing.