Loading vulnerability…
Unauthenticated Use-After-Free in MongoDB Server Replication Catch-Up
CVE-2026-118383 is a use-after-free vulnerability in MongoDB Server's replication cleanup logic executed when a newly elected replica set primary completes catch-up. Two unauthenticated ping commands containing readConcern.afterOpTime values can leave pending replication notifications, or waiters, on a vulnerable member. If that member subsequently becomes primary while behind on replication, catch-up completion can execute cleanup twice and access freed memory. This can terminate the server unexpectedly and, under certain conditions, permit arbitrary code execution in the server process context. Ordinary replica set members and shard and config server replica set members are affected; standalone mongod instances are not. The vulnerability has a CVSS v4.0 score of 9.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash a newly elected primary before it accepts writes, disrupting database availability and preventing writes until another eligible member takes over. A laboratory reproduction left the test cluster without a primary, although other deployments may recover through another election. Arbitrary code execution with the privileges of the MongoDB Server process is a possible additional impact, but researchers demonstrated only a crash, not code execution. MongoDB reported no known exploitation attempts when announcing the fixes on November 10, 2026.
If you can’t patch tonight, do this now.
Until upgrades are complete, restrict network access to MongoDB replica set members to necessary clients and cluster peers. Authentication alone does not block the unauthenticated request sequence on vulnerable versions, and network restrictions do not repair the underlying defect. Monitor structured logs for unauthenticated ping commands containing readConcern.afterOpTime that terminate with MaxTimeMSExpired, followed potentially much later by duplicate catch-up exits during one primary transition and a fatal signal involving CatchupState::abort_inlock(). Retain full command details where operationally appropriate and review earlier logs from the same member because request planting can precede failover. These signals support investigation rather than prevention.
Patch, then assume compromise.
Upgrade every affected replica set member to the applicable fixed release or a later release containing the fix: 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, or 9.0.7. Affected versions start at the initial release of each listed branch and precede its corresponding fixed version. Include all shard and config server replica set members, containerized instances, and members that were offline during maintenance; verify the versions actually running after the upgrade. MongoDB Atlas distributes fixes through cluster maintenance, and customers deferring maintenance should apply the upgrade promptly. The fix restricts readConcern.afterOpTime usage to system users and prevents duplicate cleanup when waiters are already present.
1 exploit validated by Mallory's analysis.
62 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.