A use-after-free flaw in the replication component of MongoDB Server, tracked as CVE-2026-118383, can be triggered by requests that do not require authentication. According to the NVD description, the condition can occur when a newly elected replica set primary completes catch-up. It may cause the server to terminate unexpectedly or, under certain conditions, allow arbitrary code execution in the context of the server process.
The flaw affects replica set members across seven MongoDB Server release lines, from 4.4 through 9.0. This includes the shard and config server replica set members of sharded clusters. Standalone mongod instances are not affected. NVD rates the vulnerability 10.0, the maximum CVSS score. As of the record date, it is not listed in CISA’s Known Exploited Vulnerabilities catalog.
What’s affected
The NVD record lists the following MongoDB Server version ranges as affected:
- 9.0.0 up to (but not including) 9.0.7
- 8.3.0 up to (but not including) 8.3.16
- 8.0.0 up to (but not including) 8.0.37
- 7.0.0 up to (but not including) 7.0.48
- 6.0.0 up to (but not including) 6.0.30
- 5.0.0 up to (but not including) 5.0.35
- 4.4.0 up to (but not including) 4.4.32
Only deployments running as replica set members are vulnerable. That includes the shard and config server replica sets that make up sharded clusters. Standalone mongod instances are not affected.
Each affected range ends just before a specific release, which points to those releases as the first unaffected versions. However, the advisory data supplied here doesn’t explicitly confirm them as the fixed releases. Check MongoDB’s issue tracker entries before planning upgrades.
How serious is it
NVD assigns a CVSS 3.1 base score of 10.0 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Attack vector: Network. The flaw can be reached remotely over the network.
- Attack complexity: Low. No special conditions beyond the vulnerable state are required.
- Privileges required: None. The triggering requests do not need authentication, so enabling access control alone does not prevent the issue.
- User interaction: None. No action by an administrator or user is needed.
- Scope: Changed. A successful attack can affect resources beyond the vulnerable component itself.
- Confidentiality, integrity and availability: High. At worst, an attacker could read or modify data and disrupt the service. The minimum impact described is an unexpected server crash, which is a denial of service.
The flaw is classed as CWE-416 (Use After Free).
Is it being exploited?
CVE-2026-118383 is not in CISA’s Known Exploited Vulnerabilities catalog as of the record date, 13 November 2026. The supplied records contain no reports of exploitation. Given the maximum severity score and the lack of an authentication requirement, administrators should still treat it as a priority.
What to do
- Inventory your deployments. Identify every MongoDB Server instance running as a replica set member, including shard and config server replica sets in sharded clusters, and note its version.
- Upgrade. Move affected replica set members to a release outside the affected ranges listed above, once you have confirmed the fixed versions in MongoDB’s issue tracker entries (SERVER-138119 and SERVER-138175).
- Restrict network exposure. Because no authentication is needed to trigger the flaw, make sure MongoDB ports are reachable only from trusted application hosts and other cluster members. They should never be reachable from the internet.
- Monitor for instability. Watch for unexpected
mongodterminations on replica set members, particularly around primary elections. Investigate any you find.
