Critical MongoDB Flaw CVE-2026-118383 Allows Pre-Auth Crash

The flaw affects members of a replica set, a group of servers that keep copies of the same data. One primary handles writes, and if it fails the others elect a replacement.

How it works

It is a use-after-free bug, where the server uses memory it has already freed. An attacker sends two unauthenticated requests. If that member is later elected primary while still missing some recent changes, it crashes, and the NVD entry says that under certain conditions it may even allow code execution in the server process. Datadog Security Labs reproduced the crash and noted that enabling authentication does not block the requests on vulnerable versions. MongoDB found the flaw itself and says it knows of no exploitation.

Who is affected

• Replica set members, including shard and config servers in sharded clusters.
• A standalone mongod outside any replica set is not affected.
• MongoDB Atlas clusters get the fix automatically during maintenance.
• The 8.2 branch is not officially listed, but a PoC on GitHub says 8.2.12 still showed the bug in a lab test. That branch reached end of life on July 31.

What to do

1. Upgrade every replica set member to your branch's fixed release (for example 8.0.37 for 8.0) and confirm each member's version, including containers.
2. If you defer Atlas maintenance, apply the upgrade now.
3. Until patched, restrict network access to the database to systems that need it.
4. Move off the end-of-life 8.2 branch.