Vulnerability · critical · CVSS 9.5
MongoDB use-after-free in primary catch-up process (CVE-2026-118383)
Tier A · Patch today – Before you go home
Who’s exposed: MongoDB Server deployments reachable by unauthenticated clients during primary catch-up
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Popular tool · Remote, no login · Full takeover
What to do
- Review Datadog Security Labs' detection and remediation guidance for CVE-2026-118383
The Brief
- Datadog Security Labs reproduced CVE-2026-118383, a use-after-free vulnerability in MongoDB Server's primary catch-up process.
- Unauthenticated clients can set up the condition that triggers the flaw, according to the source.
- The source describes the vulnerability as critical and explains how to detect and remediate it.
Why it matters
Operators of MongoDB Server deployments may be exposed to a critical memory-safety flaw that unauthenticated clients can reach, so checking whether their deployments are affected is a priority.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | MongoDB Server is a database that developers and ops teams build with and run. |
| No | Core infrastructure | A single database product, not software nearly every team runs like OpenSSH or the Linux kernel. |
| Yes | Popular tool | MongoDB is a widely used database used by many teams. |
| No | Exploited in the wild | Datadog Security Labs: only reproduced the flaw; no observed attacks reported. |
| No | Public exploit | Datadog Security Labs: reproduced it, but no source says exploit code or a PoC is published. |
| Yes | Remote, no login | CVSSCVE-2026-118383: CVSS 9.5 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-118383: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | Datadog Security Labs: no source reports stolen or exposed data. |
| No | Supply chain | Datadog Security Labs: a server vulnerability; no compromised package, update or pipeline reported. |
| No | No fix yet | Datadog Security Labs: explains how to remediate; no source says a fix is missing. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-118383 ↗CVSS 9.5 critical AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-416
Timeline
Datadog Security Labs published its reproduction of CVE-2026-118383 with detection and remediation guidance
Datadog Security Labs
CVE-2026-118383: Use-after-free vulnerability in MongoDB
Source
CVE-2026-118383: Use-after-free vulnerability in MongoDB ↗ Datadog Security Labs · 1d ago
First seen · 1 source · Full story page · How tiers are decided