MongoDB, as the CNA, published CVE-2026-118383 on 10 November 2026 at 22:23:51 Asia/Jerusalem (20:23:51Z). It followed with a community security announcement at 01:20:42 Asia/Jerusalem on 11 November (23:20:42Z on 10 November), titled "Important MongoDB security update available (Action Required) - November 10, 2026".
In the announcement, MongoDB says it "identified and fixed an important vulnerability (CVE-2026-118383, CVSS 9.5) that could allow unauthorized access to the MongoDB Server," that it found the issue "internally through our proactive security program," and that it is "not aware of any attempts to take advantage of this vulnerability." The announcement also says the fix "is separate from recent industry vulnerabilities and security events."
MongoDB rates the issue Critical under CVSS 4.0, base score 9.5, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The same CNA record also publishes a CVSS 3.1 score of 9.0 Critical, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Both vendor vectors list Attack Complexity as High. The CVE record lists CWE-416 (Use After Free). The CNA's source.discovery field is INTERNAL, which matches the announcement's wording that MongoDB found the issue internally.
The CNA lists fixed releases 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32. The announcement strongly recommends that all Community Edition users upgrade to a fixed release as soon as possible, says Atlas clusters are upgraded automatically to fixed versions during cluster maintenance, and strongly recommends that customers who are deferring maintenance apply the upgrade as soon as possible. The announcement points to the CVE record for the fixed versions and to the MongoDB Community downloads page. Fixes are already published; this is a patch-now advisory, not a pre-release notice.
This is a new advisory, not an update of our earlier posts on MongoBleed (CVE-2025-14847), which is a different vulnerability.
Technical Information
CVE-2026-118383. The CNA title is "Pre-authentication use-after-free in MongoDB Server replica set primary catch-up." The CVE description reads:
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
The CVE record lists two vendor references, both resolved as Fixed: SERVER-138119, "Allow only system users to use readConcern afterOpTime," and SERVER-138175, "Fix use-after-free in CatchupState::abort() reentrancy via _catchupState." Both tickets list the same generally available fix versions as the CNA record, and they also list 9.1.0 release candidates that are not on the CNA affected list. The public ticket descriptions are empty.
Researcher findings, attributed — not vendor confirmation. On 11 November 2026, Datadog Security Labs published a public analysis of CVE-2026-118383. Datadog says it reproduced a crash (a segmentation fault) on MongoDB Server 8.0.34 in a lab, and that the same failover on 8.0.37, the fixed release for the 8.0 branch, did not crash: the patched server rejected the unauthenticated requests. Datadog describes the lab trigger as two unauthenticated ping requests carrying readConcern.afterOpTime, after which the crash occurs only if that member later wins an election while it is lagging. Datadog says an attacker cannot force the lag or the election, and cannot see when either happens. Datadog also says that, on the vulnerable version it tested, enabling authentication did not prevent those two requests, because vulnerable servers accept ping before login. Datadog states it "did not achieve code execution."
The Hacker News (Swati Khandelwal, 12 November 2026) reported a public GitHub proof-of-concept whose author says 8.2.12 still showed the bug in a lab test using a test-only setting, that reliable mode needs a test-only setting a remote attacker cannot enable, and that the impact is a crash or memory corruption, with no code-execution claim. We did not fetch that repository. 8.2 is not on the CNA affected list and reached End of Life on 31 July 2026 per MongoDB's Software Lifecycle Schedules.
What official sources have not said. MongoDB has not published a confirmed exploitation case and has not published a configuration workaround other than upgrading. NVD lists the record as Awaiting Analysis as of the NVD API timestamp 2026-11-12T11:19:19.149 (13:19:19 Asia/Jerusalem), shows the CNA CVSS 4.0 9.5 and CVSS 3.1 9.0 scores as type Secondary, and has not published a separate NVD-generated primary score.
Affected Product Versions
From the CNA record for CVE-2026-118383. The product is MongoDB Server, vendor MongoDB. The record's defaultStatus is unaffected. Replica set members are affected, including shard and config server replica set members of sharded clusters. Standalone mongod instances are not affected.
| Branch | Affected range (CNA) | First fixed release |
|---|---|---|
| 9.0 | 9.0.0 to less than 9.0.7 | 9.0.7 |
| 8.3 | 8.3.0 to less than 8.3.16 | 8.3.16 |
| 8.0 | 8.0.0 to less than 8.0.37 | 8.0.37 |
| 7.0 | 7.0.0 to less than 7.0.48 | 7.0.48 |
| 6.0 | 6.0.0 to less than 6.0.30 | 6.0.30 |
| 5.0 | 5.0.0 to less than 5.0.35 | 5.0.35 |
| 4.4 | 4.4.0 to less than 4.4.32 | 4.4.32 |
A deployment already running the listed fixed release, or a later release on the same branch, is outside the affected ranges the CNA published. The CNA record does not list the 8.2 branch, or a 9.1 branch, as affected. The two Jira tickets also list 9.1.0-rc0 and 9.1.0-rc1026 among fix versions; because those trains are not on the CNA affected list, this post does not treat 9.1 as in scope.
Some listed branches are past End of Life (for example 4.4, End of Life 29 February 2024 under Enterprise Advanced), but the CNA still published a 4.4.32 fix. Operators still on a listed branch should take the CNA fixed release for that branch, and should plan a move off trains that are past vendor end of life.
MongoDB Atlas clusters, according to the announcement, receive the fixed versions automatically during cluster maintenance. Atlas customers who defer maintenance, and self-managed or Community Edition operators, should apply the fixed release as soon as possible. After upgrading, confirm the running version on every replica set member.
Exploitation Status
MongoDB says it is "not aware of any attempts to take advantage of this vulnerability." CVE-2026-118383 was not in CISA's Known Exploited Vulnerabilities catalog as of catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z (21:03:29 Asia/Jerusalem), count 1779, feed SHA-256 41c8091ad62d508d6f8906ad5cd26b20efe551f7d51b95ecc8a6981fa640b4ea, checked 12 November 2026 at 13:19 Asia/Jerusalem UTC+2. Datadog reports a lab crash reproduction, not in-the-wild exploitation, and did not achieve code execution. This post makes no exploitation claim.
Workaround and Mitigation
MongoDB's published remediation is to upgrade to a fixed release. The announcement does not list a configuration workaround.
Until a member can be upgraded, Datadog advises restricting network access to MongoDB to the specific systems that need access to it. Datadog says this limits who can send the unauthenticated requests but does not fix the use-after-free. That is researcher guidance, not a MongoDB-published workaround. Rescana agrees with that interim network restriction as guidance only; it does not replace the upgrade.
Indicators of Compromise
MongoDB has not published indicators of compromise or detection guidance for this CVE, and it is not aware of exploitation attempts. This post does not invent indicators. Datadog's lab detection notes are not vendor indicators.
What to Ask Your Suppliers and MSPs Today
Suppliers may run MongoDB Server self-managed or on Atlas. An unpatched replica set member — including a shard or config server member — is a high-value system to get onto a vendor-fixed release. This advisory is a new issue, not an update of our earlier MongoBleed (CVE-2025-14847) coverage.
Ask suppliers, in writing:
- Do they run self-managed MongoDB replica sets or sharded clusters on an affected branch (9.0, 8.3, 8.0, 7.0, 6.0, 5.0, or 4.4)?
- Is every member — including containers and members that were offline during maintenance — on a fixed release (9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, or 4.4.32, or later on that branch)?
- Are they on an end-of-life branch such as 8.2, which reached end of life on 31 July 2026 per MongoDB's lifecycle schedule, is not on the CNA affected list, and has no listed fix in the CVE record?
- If they use Atlas, is maintenance being deferred, and when will the fixed version be applied?
Until they have upgraded, ask them to restrict MongoDB so it is not reachable from untrusted networks (researcher and Rescana guidance, not a MongoDB workaround). If you operate MongoDB Server yourself, apply the fixed release first, then confirm the same points against your inventory.
Need help working through suppliers that run self-managed MongoDB replica sets or defer Atlas maintenance, and may be exposed to CVE-2026-118383? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- MongoDB community security announcement, 10–11 November 2026 — created 2026-11-10T23:20:42.109Z (11 November 2026, 01:20:42 Asia/Jerusalem UTC+2); MongoDB says it found the issue internally, is "not aware of any attempts to take advantage of this vulnerability," recommends Community Edition users upgrade as soon as possible, and says Atlas clusters are upgraded automatically during maintenance.
- CVE-2026-118383 (CNA mongodb; CVE List JSON) — published 2026-11-10T20:23:51.424Z (22:23:51 Asia/Jerusalem); CVSS 4.0 9.5 Critical and CVSS 3.1 9.0 Critical; CWE-416; fixed releases 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32.
- SERVER-138119 and SERVER-138175 — vendor references listed in the CVE record; both resolved as Fixed; generally available fix versions match the CNA list; also list 9.1.0-rc0 and 9.1.0-rc1026, which are not on the CNA affected list.
- MongoDB Community downloads page — linked from the announcement as the location of fixed releases.
- NVD CVE-2026-118383 — vulnStatus Awaiting Analysis as of the NVD API timestamp 2026-11-12T11:19:19.149 (13:19:19 Asia/Jerusalem); CNA scores shown as type Secondary; no NVD-generated primary score.
- CISA vulnerability catalog JSON feed — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z (21:03:29 Asia/Jerusalem), count 1779, feed SHA-256
41c8091ad62d508d6f8906ad5cd26b20efe551f7d51b95ecc8a6981fa640b4ea; CVE-2026-118383 is not in CISA KEV as of 12 November 2026 at 13:19 Asia/Jerusalem UTC+2. - Datadog Security Labs, "CVE-2026-118383: Use-after-free vulnerability in MongoDB," 11 November 2026 — lab crash reproduced on 8.0.34, not on 8.0.37; authors state they "did not achieve code execution"; advises restricting network access as an interim control.
- The Hacker News, Swati Khandelwal, 12 November 2026 — published 2026-11-12T14:55:00+05:30 (11:25 Asia/Jerusalem); secondary coverage of a public GitHub proof-of-concept and a claim about 8.2.12 with a test-only setting. This post did not fetch that repository.
- MongoDB Software Lifecycle Schedules — MongoDB 8.2 released September 2025, End of Life date 31 July 2026; MongoDB 4.4 End of Life 29 February 2024.
- MongoBleed (CVE-2025-14847) — prior Rescana coverage of a different MongoDB Server vulnerability; this CVE-2026-118383 post is new and does not update that slug.
