MongoDB Server: Pre-authentication use-after-free in replication

Summary

A use-after-free in the replication component of MongoDB Server can be triggered when a newly elected replica set primary completes catch-up. Requests that do not require authentication can cause the server to terminate unexpectedly or, under certain conditions, execute arbitrary code in the server process. Only replica set members are affected, including shard and config server members; standalone mongod instances are not.

Affected

• MongoDB Server 9.0.0 to before 9.0.7
• MongoDB Server 8.3.0 to before 8.3.16
• MongoDB Server 8.0.0 to before 8.0.37
• MongoDB Server 7.0.0 to before 7.0.48
• MongoDB Server 6.0.0 to before 6.0.30
• MongoDB Server 5.0.0 to before 5.0.35
• MongoDB Server 4.4.0 to before 4.4.32
• Only replica set members (including shard and config servers); standalone mongod instances are not affected

Fixed in

• 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, 4.4.32 (fix versions listed in the MongoDB Jira tickets)
• Release availability and the official MongoDB security advisory were not confirmed; verify before patching

Workaround

• Unknown. No vendor-documented workaround found.
• Restrict network access to mongod ports to application servers and replica set members, and do not expose them to the internet.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• One aggregator reports that the flaw is not listed in CISA KEV.

Our recommendation

• Identify MongoDB instances and distinguish replica set members from standalone instances.
• Restrict network access to database ports and never expose them to the internet.
• Plan patching to the fixed release for each branch and apply it as soon as MongoDB's advisory confirms the versions.
• Monitor replica set members for unexpected crashes or restarts of mongod.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  googlesky/CVE-2026-118383

Research sources

• MongoDB Jira SERVER-138119 jira.mongodb.org
• MongoDB Jira SERVER-138175 jira.mongodb.org
• CVE-2026-118383 details (threatint) cve.threatint.com
• OffSeq radar: CVE-2026-118383 radar.offseq.com
• MongoDB 9.0 release notes www.mongodb.com
• MongoDB 8.0 release notes www.mongodb.com
• endoflife.date: MongoDB support lifecycle endoflife.date

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:26.