Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-118383 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | MongoDB |
| Product | MongoDB Server |
| Vulnerability Type | use-after-free (CWE-416) |
| CVSS Score | 9.0 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
The high attack complexity (AC:H in the CVSS vector) means the attacker has to hit the moment a new primary is elected, but needs no credentials to do so.
Required Actions
- Update MongoDB Server to the fixed version referenced in MongoDB tickets SERVER-138119 and SERVER-138175.
- Restrict network access to MongoDB ports (27017/TCP by default) to application servers only — the database should not be reachable from the internet.
- For MongoDB Atlas, check the provider’s notices about cluster updates.
Who Is Affected?
The vulnerability affects MongoDB Server running as a replica set, including sharded clusters. Standalone mongod instances are not affected.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-118383 vulnerability?
CVE-2026-118383 is a use-after-free flaw (CWE-416) in the MongoDB Server replication component that may lead to a server crash or code execution. CVSS score: 9.0.
Does exploiting CVE-2026-118383 require authentication?
No. The condition can be triggered by requests that do not require authentication, although the attack complexity is high.
How to protect against CVE-2026-118383?
Update MongoDB Server to the fixed version and restrict network access to the database ports.
Who is affected by CVE-2026-118383?
Organizations running MongoDB Server as a replica set or sharded cluster.
