Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

A critical flaw discovered in MongoDB Server can lead to a crash when an unauthenticated attacker sends two specific requests to the database server. This issue arises only if the server is subsequently chosen to take over as the main server while it still lacks certain recent changes. MongoDB has released fixed versions to address this vulnerability.

The affected servers are part of a replica set, a collection of MongoDB servers that maintain identical data copies. One member in the set, known as the primary, serves as the main server and manages all new writes, while the others replicate them. If the primary becomes unavailable, other members hold an election to select a new primary.

Researchers at Datadog Security Labs recreated the crash in a lab environment and published their findings. They found that even when authentication is enabled, the two requests still trigger the crash. MongoDB has rated this vulnerability a 9.5 out of 10 on the CVSS 4.0 severity scale. The company is unaware of any attempts to exploit this vulnerability.

Affected members include shard and config server members of sharded clusters, as well as standalone mongod instances outside any replica set. However, MongoDB Atlas clusters automatically receive the fixed versions during maintenance. Customers who delay maintenance should apply the upgrade promptly.

The flaw, identified as CVE-2026-118383, is a type of vulnerability known as a use-after-free, where the server uses memory that has already been freed. MongoDB has rated the severity of this vulnerability very high. The researchers advise restricting network access to the database to only necessary systems to limit the potential for exploitation. They also suggest upgrading the affected servers as soon as possible to mitigate the risk.