cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

MongoDB Patches Critical Unauthenticated Flaw That Can Crash Lagging Replica-Set Members

· Original article ↗

Summary

CVE-2026-118383 lets unauthenticated clients send two requests that can trigger a crash when a lagging MongoDB replica-set member wins failover. MongoDB released fixes; researchers did not achieve code execution in their lab.

Key points

  • The use-after-free flaw involves two ping requests carrying readConcern.afterOpTime; cleanup can run twice after a lagging member wins an election and finishes catching up.
  • Enabling authentication does not block the requests, but an attacker cannot cause the target to fall behind or win an election, or observe when those conditions occur.
  • MongoDB rated the flaw 9.5/10 on CVSS 4.0 and said it was not aware of attempts to exploit it.
  • Replica-set members, including shard and config server members in sharded clusters, are affected; standalone mongod servers are not.
  • Researchers reproduced a crash on 8.0.34; in their test, fixed version 8.0.37 rejected the requests. MongoDB says the flaw may allow code execution under certain conditions, but researchers did not achieve it in the lab.
  • MongoDB Atlas clusters receive fixes during maintenance. Self-managed deployments should upgrade every replica-set member; until then, restrict database network access to systems that need it.
  • A proof of concept reports the bug on 8.2.12 in a lab using a test-only setting, although the 8.2 branch is not listed as affected.

Article Details

Vulnerability Types
  • Use-after-free
Severity
Critical; MongoDB rated it 9.5 out of 10 on the CVSS 4.0 scale.
Affected Versions
  • MongoDB Server 8.0.34 (vulnerable in the researchers' lab test)
  • MongoDB Server 8.2.12 (the proof of concept reported the bug in a lab using a test-only setting; the 8.2 branch was not listed among affected versions)
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Until upgrading, restrict database network access to only the systems that need it; this limits who can send the requests but does not fix the flaw.

MITRE ATT&CK

T1499.004 · Application or System ExploitationThe two unauthenticated requests can trigger a use-after-free crash in the MongoDB server process when a lagging replica-set member wins an election and completes catch-up.

CVE

CVE-2026-118383MongoDB · MongoDB ServerThe flaw, tracked as CVE-2026-118383, is a use-after-free: the server ends up using memory it has already freed. MongoDB rated it 9.5 out of 10 on the CVSS 4.0 severity scale. The company said it found the flaw itself

Vendors

MongoDBA critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server

Products

MongoDB AtlasMongoDB Atlas clusters automatically receive fixed versions during maintenance, the company said in its security announcement. Customers who defer maintenance should apply the upgrade as soon as possible.MongoDB ServerA critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server

Related Articles