Vulnerabilities & Exploits

MongoDB replica-set flaw can crash sharded database members

Datadog Security Labs reproduced an unauthenticated crash in MongoDB Server 8.0.34, tied to CVE-2026-118383. The use-after-free affects replica-set members, including those running shards and config servers in sharded clusters; standalone mongod instances are unaffected. MongoDB said it knew of no exploitation attempts when it announced the security update.

When a replica-set member is elected primary, it first catches up on database operations it missed. An unauthenticated client can prepare the vulnerable condition with two ping requests, which MongoDB accepts before login, so enabling authentication does not block the trigger. During the brief catch-up, the flaw can make the member crash and disrupt database availability.

In sharded deployments, the exposure includes replica-set members behind both shards and config servers, not only application-facing database nodes. For those environments, network reachability—not login settings—sets the practical exposure boundary until affected members are upgraded.

2 sources · Nov 12

CVE-2026-118383

NVD KEV

Published Nov 10 by MongoDB

CVSS 9 CRITICAL: a use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up.

Timeline

Sources

Part of the PlainSec briefing for 2026-11-12

Every edition of this story: MongoDB replica-set flaw can crash sharded database members

More from today