---
id: "CVE-2026-118383"
page: "https://infrastack.ai/live/CVE-2026-118383"
kind: "vulnerability"
aliases: ["CVE-2026-118383"]
title: "MongoDB Server: replication use-after-free can let unauthenticated requests run code"
severity: "critical"
cvss: 9.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "MongoDB Server", "fixed": ["9.0.7", "8.3.16", "8.0.37", "7.0.48", "6.0.30", "5.0.35", "4.4.32"], "affected": ">=9.0.0 <9.0.7 || >=8.3.0 <8.3.16 || >=8.0.0 <8.0.37 || >=7.0.0 <7.0.48 || >=6.0.0 <6.0.30 || >=5.0.0 <5.0.35 || >=4.4.0 <4.4.32", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["mongodb", "replica-set", "self-hosted", "sharded-cluster", "vendor"]
not_affected_if: ["standalone-mongod"]
published_at: "2026-11-10T21:18:58+00:00"
first_seen_at: "2026-11-10T21:46:14+00:00"
updated_at: "2026-11-10T21:49:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118383", "first_seen_at": "2026-11-10T21:46:14+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118383", "first_seen_at": "2026-11-10T21:49:24+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-118383", "https://jira.mongodb.org/browse/SERVER-138119"]}]
exploit_sources: []
---

# MongoDB Server: replication use-after-free can let unauthenticated requests run code

Link for people: https://infrastack.ai/live/CVE-2026-118383 (this .md is for agents)

A use-after-free bug in MongoDB Server's replication component happens when a newly elected primary finishes catch-up. Requests that need no login can crash the server or, under certain conditions, run arbitrary code inside the server process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >=9.0.0 <9.0.7 || >=8.3.0 <8.3.16 || >=8.0.0 <8.0.37 || >=7.0.0 <7.0.48 || >=6.0.0 <6.0.30 || >=5.0.0 <5.0.35 || >=4.4.0 <4.4.32 fixed 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, 4.4.32

## How to check

Run db.version() on every replica set member, including shard and config server members, and compare with the fixed versions. Versions below 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 on the same release line are affected if the member is in a replica set. Standalone mongod is not affected.

## Fix

Upgrade to MongoDB 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 (the fix versions on MongoDB's SERVER-138119).

## Timeline

- 2026-11-10T21:46:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118383
- 2026-11-10T21:49:24+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-118383 — Fix versions read on MongoDB Jira SERVER-138119 (fix verified). Affected ranges come from a HOL rewrite of the CVE record, not read on a MongoDB page, so unverified. MongoDB's alerts page does not list this CVE yet. No mitigation or exploitation found. Jira title is 'Allow only system users to use readConcern afterOpTime', which hints at the trigger path but is not stated as such.

## Documents

- [advisory] NVD CVE-2026-118383 (CNA: MongoDB) https://nvd.nist.gov/vuln/detail/CVE-2026-118383
- [fix] SERVER-138119 Allow only system users to use readConcern afterOpTime https://jira.mongodb.org/browse/SERVER-138119

## From the sources

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_