Vulnerability · critical · CVSS 9.5
Critical pre-auth MongoDB flaw CVE-2026-118383 can crash servers
Tier A · Patch today – Before you go home
Who’s exposed: MongoDB Server replica set members that lag behind during failover
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Popular tool · Remote, no login · Full takeover
What to do
- Apply the MongoDB Server patches released for CVE-2026-118383.
The Brief
- CVE-2026-118383 is a critical pre-auth flaw in MongoDB Server, rated 9.5 CVSS by DEV Community.
- An unauthenticated attacker can send two requests that trigger a use-after-free during replica set catch-up cleanup.
- The crash happens only if the affected server is later chosen as primary while still missing recent changes; MongoDB has released patches and no active exploitation is noted.
Why it matters
Unauthenticated attackers can crash MongoDB servers, and a lagging replica set member that is promoted to primary during failover may go down, which can disrupt database availability. Teams running MongoDB replica sets should patch.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | MongoDB Server is a database that developers and ops teams run and operate. |
| No | Core infrastructure | Judgment: a single database product, not foundational software like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: MongoDB is a widely used database used by many development teams. |
| No | Exploited in the wild | DEV Community: MongoDB notes no active exploitation of the flaw. |
| No | Public exploit | Neither source says exploit code or a proof-of-concept is published. |
| Yes | Remote, no login | CVSSCVE-2026-118383: CVSS 9.5 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-118383: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | Sources describe only a crash; no data theft or exposure is reported. |
| No | Supply chain | A server crash flaw in MongoDB; no compromised package, update or build pipeline is reported. |
| No | No fix yet | DEV Community: MongoDB released patches for the flaw. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-118383 ↗CVSS 9.5 critical AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-416
Timeline
Datadog Security Labs
CVE-2026-118383: Use-after-free vulnerability in MongoDB
Flaw publicly reported and MongoDB released patches
The Hacker News
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
DEV Community: backend
Serious security flaw in MongoDB: How your database could collapse
Full coverage · 3 sources
- 1h ago ↗
DEV Community: backend
Serious security flaw in MongoDB: How your database could collapse - 2h ago ↗
The Hacker News
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover - 2d ago ↗
Datadog Security Labs
CVE-2026-118383: Use-after-free vulnerability in MongoDB
First seen · 3 sources · Full story page · How tiers are decided