MongoDB CVE-2026-118383: pre-auth UAF, patch replica sets
MongoDB shipped fixed releases on Tuesday for CVE-2026-118383, a use-after-free that can kill a replica set’s freshly elected primary before it accepts a write. The scores are already in: NVD rates 10.0 on CVSS 3.1, and MongoDB’s CNA puts it 9.5 on v4.0. There’s no CISA KEV entry and MongoDB says it’s unaware of exploitation attempts, but a proof of concept is public on GitHub. Patch every replica set member this week.
The attack has two halves. The attacker’s half is cheap: two unauthenticated ping commands carrying a readConcern.afterOpTime value. Vulnerable servers accept ping before you log in, so switching authentication on does not block them; part of the fix closes that by restricting the field to system users. Each request registers a waiter, a pending notification asking the server to hold until replication reaches a point. Waiters never expire; they sit until the member restarts, rolls back, or steps down.
The detonator is the part nobody controls. The waiters only matter if that same member later falls behind on replication and then wins an election while still behind another member. When catch-up ends, the cleanup runs twice, memory that was already freed gets reused, and the new primary drops with a segmentation fault in CatchupState::abort_inlock() before accepting any writes. Datadog Security Labs published the working analysis: their lab run crashed 8.0.34 exactly that way, and on the fixed 8.0.37 both requests came back Unauthorized immediately and the member sailed through the same failover.
The advisory claims arbitrary code execution is possible under certain conditions; the lab never achieved it, and the PoC’s reliable mode needs a test-only setting no remote attacker can flip. Demonstrated so far: crash.
Who’s in scope: replica set members, including the shard and config server members inside sharded clusters. A standalone mongod skips primary catch-up and isn’t affected, so a version scanner flagging every mongo binary is overcounting; topology decides. Every supported branch got a fix: 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32, and every earlier release in each branch is affected back to the branch’s first build. Verify the version on every member after upgrading, including containers and anything that was offline during the maintenance window. Atlas patches automatically during cluster maintenance; if you’ve been deferring maintenance, stop deferring. The 8.2 branch isn’t listed because it hit end of life July 31, and no fix is coming for it: get off 8.2.
While you upgrade, restrict network access to the database to the systems that actually need it. That shrinks who can plant waiters and fixes nothing on its own. The published hunt works from server logs: event 51803, a COMMAND slow query for an unauthenticated ping carrying readConcern.afterOpTime that ends MaxTimeMSExpired; a member entering primary catch-up (event 21359) then exiting it twice (event 21363) in one transition; then a fatal signal or backtrace naming CatchupState::abort_inlock(). Requests can be planted long before the crash, so the telling logs often sit hours earlier on the same member.
My read: this is a bear trap with an unowned trigger. The attacker pays almost nothing for the two requests and controls none of the timing; the payoff waits for a routine maintenance failover or an outage to land wrong. Networks that let the world reach 27017 carry the real risk; everyone else is doing a scheduled patch.
Questions or war stories: info@stackref.com.
This post was created with a Hermes AI agent (hermesagent.ai) from a weekly news gathering workflow, then reviewed and approved by Keith before publication.
