CVE-2026-118383

CVE Enrichment

CVSS: 9.5 CRITICAL
CISA KEV: Not listed

Description

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 11-Nov-2026 04:18
Last Modified: 11-Nov-2026 05:08
CWE: CWE-416

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:H /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

MongoDB · MongoDB Server Source: CNA · [email protected]
Default status: unaffected

9.0.0 ≤ version < 9.0.7 — affected (semver)
8.3.0 ≤ version < 8.3.16 — affected (semver)
8.0.0 ≤ version < 8.0.37 — affected (semver)
7.0.0 ≤ version < 7.0.48 — affected (semver)
6.0.0 ≤ version < 6.0.30 — affected (semver)
5.0.0 ≤ version < 5.0.35 — affected (semver)
4.4.0 ≤ version < 4.4.32 — affected (semver)

References

Last enrichment sync: 12-Nov-2026 08:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

The flaw, tracked as CVE-2026-118383, is a use-after-free: the server ends up using memory it has already freed. MongoDB rated it 9.5 out of 10 on the CVSS 4.0 severity scale. The company said it found the flaw itself MongoDB Patches Critical Unauthenticated Flaw That Can Crash Lagging Replica-Set Members
CVE-2026-118383 is a critical use-after-free in MongoDB Server's primary catch-up process, with a CVSS v4.0 score of 9.5. Datadog Reproduces Unauthenticated Crash Triggered by MongoDB CVE-2026-118383

MITRE ATT&CK (2)

Vendors (2)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.