Skip to content
Critical MongoDB Vulnerability CVE-2026-118383 Allows Server Crashes

Critical MongoDB Vulnerability CVE-2026-118383 Allows Server Crashes

First seen 12 Nov 2026, 11:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 11:18 UTC
  • •CVE-2026-118383 is a critical use-after-free vulnerability with a CVSS score of 9.5.
  • •Unauthenticated attackers can exploit the flaw to crash MongoDB replica set members during failover.
  • •MongoDB has released patched versions and urges users to upgrade immediately.

MongoDB has patched a critical vulnerability, CVE-2026-118383, in its Server software that allows unauthenticated clients to send two specific requests that can crash a replica set member during a failover. The flaw, an use-after-free issue, has a CVSS score of 9.5, indicating its high severity. It affects replica set members, including those used by shards and config servers, but standalone mongod instances are not impacted. The vulnerability was discovered internally by MongoDB, which has stated it is not aware of any attempts. Datadog Security Labs reproduced the crash in a lab environment, confirming the vulnerability's potential for exploitation. Users are urged to upgrade to patched versions immediately, as enabling authentication does not mitigate the risk. The first public proof of concept (PoC) was released on November 11, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-11-10
MongoDB announces security update
MongoDB disclosed CVE-2026-118383, a critical vulnerability affecting replica set members.
Finance.Biggo
2026-11-10
CVE-2026-118383 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-11
First public PoC released
Datadog Security Labs published a proof of concept demonstrating the crash caused by the vulnerability.
Thehackernews

More articles in this cluster (7)

Following this threat?

Track CVE-2026-118383 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which MongoDB versions are affected?
All versions prior to the fixed releases in the 8.0 and 8.1 branches are affected, including 8.0.34.
Is there evidence of active exploitation?
No, MongoDB stated it is not aware of any attempts to exploit this vulnerability.
What should I do if I'm using MongoDB?
Upgrade to the latest patched version immediately to mitigate the risk of this vulnerability.