Security · High impactFan score 66 · Tier A3 sources

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

The Hacker News · 2h ago

The Brief · written from 3 sources

CVE-2026-118383 is a critical pre-auth flaw in MongoDB Server, rated 9.5 CVSS by DEV Community.
An unauthenticated attacker can send two requests that trigger a use-after-free during replica set catch-up cleanup.
The crash happens only if the affected server is later chosen as primary while still missing recent changes; MongoDB has released patches and no active exploitation is noted.

Why it matters

Unauthenticated attackers can crash MongoDB servers, and a lagging replica set member that is promoted to primary during failover may go down, which can disrupt database availability. Teams running MongoDB replica sets should patch.

Who’s affected

Operators of MongoDB Server replica sets

What to do

Apply the MongoDB Server patches released for CVE-2026-118383.

CVE-2026-118383
#mongodb
#security
#vulnerability
#replica-set
#database
#cve

A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the…

Read the full story at thehackernews.com ↗