Short answer: A critical flaw in MongoDB can crash a server during a failover. Upgrade to the latest version and restrict network access.
TL;DR
- Vulnerable MongoDB versions can crash during a failover.
- Replica set members and sharded clusters are affected.
- Upgrade to the latest fixed release.
- Limit network access until upgraded.
What is CVE-2026-118383?
This is a critical flaw in MongoDB, specifically in the replication process of replica set members. An unauthenticated attacker can send two requests that, if the targeted server later becomes the primary during a failover, can crash the server. The issue affects replica set members, shard and config servers in sharded clusters, but standalone MongoDB instances are not impacted. MongoDB has released fixed versions for affected branches. It is important to upgrade and restrict network access to mitigate the risk.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- CVE
- A public ID number (like CVE-2026-12345) given to a known security weakness so everyone can talk about the same bug.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 12 Nov 2026 |
| CVE | CVE-2026-118383 |
| CVSS | 9.5 CRITICAL CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-416 (use after free) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Affected product | MongoDB |
| Published in NVD | 2026-11-10 (CVE-2026-118383) |
How it works
A bug in MongoDB can crash servers. When a server falls behind and becomes primary, it can crash during catch-up. Attackers send two unauthenticated requests that plant waiters, then win an election. The server crashes when it tries to clean up after catch-up.
- Attacker reaches the MongoDB over the internet / network
- No login or account is needed
- Sends crafted input that triggers the use after free flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-10 | CVE-2026-118383 published in NVD | NVD |
| 2026-11-12 | Reported by The Hacker News | The Hacker News |
| 2026-11-12 | This Skillmate explainer published | Skillmate |
How to fix it
- Update MongoDB to the fixed release named in the vendor advisory.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-118383 is a real NVD record scored 9.5 CRITICAL | CISA KEV does not list CVE-2026-118383 as exploited in the wild |
| Reported by The Hacker News | NVD links no vendor advisory for CVE-2026-118383 yet |
| Reported by github.com | |
| Reported by securitylabs.datadoghq.com |
Why it matters
This flaw can crash critical databases, affecting services and data.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is a replica set in MongoDB?
A replica set in MongoDB is a group of servers that keep copies of the same data. One server handles all new writes, while the others replicate them.
How can I protect my MongoDB server from this flaw?
Upgrade to a fixed version, restrict network access to specific systems, and check the version running on each member after the upgrade.
What versions are affected by this flaw?
Versions before 8.0.37 of the 8.0 branch, and before the backport of the fix on the 8.2 branch, are affected.
Related Skillmate posts
Sources
- Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover (The Hacker News)
- Primary source / advisory (github.com)
- Primary source / advisory (securitylabs.datadoghq.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.