{"id":"CVE-2026-118383","kind":"vulnerability","aliases":["CVE-2026-118383"],"related":[],"title":"MongoDB Server: replication use-after-free can let unauthenticated requests run code","description":"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.","summary":"A use-after-free bug in MongoDB Server's replication component happens when a newly elected primary finishes catch-up. Requests that need no login can crash the server or, under certain conditions, run arbitrary code inside the server process.","severity":"critical","cvss":9.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["9.0.7","8.3.16","8.0.37","7.0.48","6.0.30","5.0.35","4.4.32"],"affected":">=9.0.0 <9.0.7 || >=8.3.0 <8.3.16 || >=8.0.0 <8.0.37 || >=7.0.0 <7.0.48 || >=6.0.0 <6.0.30 || >=5.0.0 <5.0.35 || >=4.4.0 <4.4.32","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["mongodb","replica-set","self-hosted","sharded-cluster","vendor"],"not_affected_if":["standalone-mongod"],"how_to_check":"Run db.version() on every replica set member, including shard and config server members, and compare with the fixed versions. Versions below 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 on the same release line are affected if the member is in a replica set. Standalone mongod is not affected.","fix":"Upgrade to MongoDB 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 (the fix versions on MongoDB's SERVER-138119).","status":"open","published_at":"2026-11-10T21:18:58+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:47:41+00:00","updated_at":"2026-11-10T21:49:24+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T21:47:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: replication use-after-free can let unauthenticated requests run code","impact":"high","summary":"A use-after-free bug in MongoDB Server's replication component happens when a newly elected primary finishes catch-up. Requests that need no login can crash the server or, under certain conditions, run arbitrary code inside the server process.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["mongodb","self-hosted","replica-set","sharded-cluster"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server crashes, or code runs in the mongod process","analyst_note":"Find the affected and fixed MongoDB Server versions and any mitigation in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118383) or MongoDB's advisory.","how_to_check":"unknown","plain_action":"","product_name":"MongoDB Server","needs_analyst":true,"not_affected_if":["standalone-mongod"],"who_is_affected":"Replica set members are affected, including the shard and config server replica sets of sharded clusters. Standalone mongod instances are not affected, so check whether your deployment runs replica sets. The sources do not list fixed versions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4587,"output_tokens":503,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed MongoDB Server versions and any mitigation in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118383) or MongoDB's advisory.","search":"'-118383':16A,19A '-2026':15A,18A 'affect':138C 'arbitrari':69B,124C 'authent':111C 'bug':38B 'catch':53B,98C 'catch-up':52B,97C 'caus':104C 'certain':66B,122C 'cluster':31B,150C 'code':13A,70B,125C 'complet':96C 'compon':44B,83C 'condit':67B,101C,123C 'config':143C 'context':129C 'crash':61B 'cve':14A,17A 'elect':49B,92C 'execut':126C 'finish':51B 'free':7A,37B,79C 'happen':45B 'host':28B 'includ':139C 'insid':71B 'instanc':153C 'let':9A 'login':59B 'may':113C 'member':136C,147C 'mongod':152C 'mongodb':1A,20A,22B,40B,85C 'need':57B 'newli':48B,91C 'occur':88C 'primari':50B,95C 'process':74B,133C 'replic':3A,43B,82C 'replica':24B,93C,134C,145C 'replica-set':23B 'request':11A,55B,106C 'requir':110C 'result':114C 'run':12A,68B 'self':27B 'self-host':26B 'server':2A,21A,41B,63B,73B,86C,117C,132C,144C 'set':25B,94C,135C,146C 'shard':30B,141C,149C 'sharded-clust':29B 'standalon':151C 'termin':118C 'unauthent':10A 'unexpect':119C 'use':5A,35B,77C 'use-after-fre':4A,34B,76C 'vendor':32B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted MongoDB Server deployments that run as a replica set, including the shard and config server replica sets of sharded clusters. The flaw is reachable by requests that need no login, so network exposure of mongod matters. Standalone mongod instances are not affected, and the sources do not say whether Atlas is affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:49:24Z","by":"analyst","doc":"https://nvd.nist.gov/vuln/detail/CVE-2026-118383","run_id":2860}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["critical","mongodb","replicaset","selfhosted","shardedcluster","vendor"],"campaign_type":null,"search_a":"'-118383':16A,19A '-2026':15A,18A 'code':13A 'cve':14A,17A 'free':7A 'let':9A 'mongodb':1A,20A 'replic':3A 'request':11A 'run':12A 'server':2A,21A 'unauthent':10A 'use':5A 'use-after-fre':4A","search_b":"'arbitrari':69B 'bug':38B 'catch':53B 'catch-up':52B 'certain':66B 'cluster':31B 'code':70B 'compon':44B 'condit':67B 'crash':61B 'elect':49B 'finish':51B 'free':37B 'happen':45B 'host':28B 'insid':71B 'login':59B 'mongodb':22B,40B 'need':57B 'newli':48B 'primari':50B 'process':74B 'replic':43B 'replica':24B 'replica-set':23B 'request':55B 'run':68B 'self':27B 'self-host':26B 'server':41B,63B,73B 'set':25B 'shard':30B 'sharded-clust':29B 'use':35B 'use-after-fre':34B 'vendor':32B","search_c":"'affect':138C 'arbitrari':124C 'authent':111C 'catch':98C 'catch-up':97C 'caus':104C 'certain':122C 'cluster':150C 'code':125C 'complet':96C 'compon':83C 'condit':101C,123C 'config':143C 'context':129C 'elect':92C 'execut':126C 'free':79C 'includ':139C 'instanc':153C 'may':113C 'member':136C,147C 'mongod':152C 'mongodb':85C 'newli':91C 'occur':88C 'primari':95C 'process':133C 'replic':82C 'replica':93C,134C,145C 'request':106C 'requir':110C 'result':114C 'server':86C,117C,132C,144C 'set':94C,135C,146C 'shard':141C,149C 'standalon':151C 'termin':118C 'unexpect':119C 'use':77C 'use-after-fre':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118383","severity":null,"published_at":"2026-11-10T21:18:58+00:00","modified_at":"2026-11-10T21:18:58+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118383:2860","url":"https://jira.mongodb.org/browse/SERVER-138119","severity":null,"published_at":"2026-11-10T21:49:24+00:00","modified_at":"2026-11-10T21:49:24+00:00","first_seen_at":"2026-11-10T21:49:24+00:00","fetched_at":"2026-11-10T21:49:24+00:00","note":"Fix versions read on MongoDB Jira SERVER-138119 (fix verified). Affected ranges come from a HOL rewrite of the CVE record, not read on a MongoDB page, so unverified. MongoDB's alerts page does not list this CVE yet. No mitigation or exploitation found. Jira title is 'Allow only system users to use readConcern afterOpTime', which hints at the trigger path but is not stated as such.","cites":["https://jira.mongodb.org/browse/SERVER-138119","https://nvd.nist.gov/vuln/detail/CVE-2026-118383"]}],"documents":[{"id":119287,"url":"https://jira.mongodb.org/browse/SERVER-138119","title":"SERVER-138119 Allow only system users to use readConcern afterOpTime","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119288,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118383","title":"NVD CVE-2026-118383 (CNA: MongoDB)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}