Datadog Security Labs published research on November 11 detailing CVE-2026-118383, a pre-authentication use-after-free flaw in MongoDB Server that lets unauthenticated attackers crash members of a replica set. MongoDB rates it 9.5 on CVSS 4.0 and released fixed versions earlier in the week.
A Use-After-Free Reachable Without Authentication
The vulnerability is a use-after-free that an attacker can trigger before authenticating. Two crafted requests cause the crash, and authentication does not block them. Datadog reproduced the crash and published its findings on November 11.
The Election Condition Behind the Crash
The crash occurs only under a specific sequence. The affected member must later win an election and become the primary while it is lagging on recent changes. That condition ties the impact to failover events, when a secondary takes over as primary.
Which MongoDB Deployments Are Affected by CVE-2026-118383
The flaw affects MongoDB Server replica set and sharded cluster members. Standalone mongod instances are not affected. Shard and config server members of sharded clusters fall within the affected set.
MongoDB’s Position and Patch Delivery
MongoDB found the flaw itself and says it knows of no exploitation attempts. The company rates the issue 9.5 on CVSS 4.0, which places it in the critical range.
Atlas Clusters Versus Self-Managed MongoDB Deployments
Atlas clusters receive the fix automatically during maintenance windows. Self-managed deployments need the fixed release installed on every replica set member. Because the crash depends on a particular member becoming primary, an unpatched member in an otherwise patched set can still expose the cluster.
Potential MongoDB Outage During Replica Set Failover
The expected impact is a database outage during failover for unpatched replica sets. An attacker who sends the two crafted requests to a member that later becomes primary can take that member down at the moment the cluster depends on it.
The Hacker News, the only outlet covered in the research for this report, says the guidance from the research is to upgrade every member to the fixed release for its branch. No CVE-specific version numbers were given in the source material, so administrators must consult MongoDB’s own release notes for the fixed version on each branch.
Why the Failover Trigger Shapes the Risk
The requirement that a crashed member later win an election makes the vulnerability harder to weaponize reliably than a simple remote crash. An attacker cannot control when elections happen, though sending the crafted requests costs little, and authentication does not stop them.
For operators of sharded clusters, the inclusion of config server members matters, since those servers hold cluster metadata. The flaw also illustrates how a pre-authentication bug in a core network-facing parser can carry a critical rating even when the demonstrated consequence is a crash rather than code execution. MongoDB has not reported any in-the-wild use, and Datadog’s write-up is the main public technical analysis so far.
Reporting Sources and Remaining Unknowns on CVE-2026-118383
The Hacker News is the sole outlet cited for this advisory, and it relies on Datadog Security Labs’ November 11 write-up together with MongoDB’s own severity assessment. The fixed versions were released earlier in the week of November 9, before Datadog’s publication.
The coverage does not name the fixed release numbers for each MongoDB branch, and it does not report any exploitation. MongoDB states that it knows of no attempts, and Datadog’s contribution was to reproduce the crash independently and publish the findings.
The combination of a vendor-found bug, a researcher reproduction and no known abuse places the flaw in the category of coordinated, defender-first disclosures. The CVSS 4.0 score of 9.5 reflects the lack of authentication and the network reachability of the requests, while the election condition limits when the crash actually lands. Shard and config server members of sharded clusters are included in the affected set, which broadens the population beyond ordinary replica sets.
