thehackernews.com
Nov 12, 2026
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
AI-summarised brief · reviewed before publication
MongoDB identified a critical use‑after‑free flaw (CVE‑2026‑118383) that lets an unauthenticated attacker send two ping requests to a replica‑set member. The requests trigger a crash only when the targeted member later becomes primary while still lagging behind. The issue affects all sharded cluster members and replica‑set nodes, but not standalone mongod instances. MongoDB released patched versions across affected branches, and Atlas clusters receive updates automatically. Users of self‑managed deployments must upgrade every replica‑set member promptly.
💡 Why It Matters
- · The vulnerability exposes a pathway for attackers to destabilize database clusters during failover, potentially disrupting critical services that rely on MongoDB’s high‑availability architecture.
- · Prompt patching is essential to maintain operational continuity in environments where replication lag and failover are common.
