Unauthenticated MongoDB flaw can crash replica set members during failover
Self-managed operators must upgrade every member, while 8.2 users now face an end-of-life branch with no further security fixes.
MongoDB has shipped fixed releases for CVE-2026-118383, a use-after-free flaw rated 9.5 out of 10 on CVSS 4.0 that lets an unauthenticated client crash a replica set member. The attacker needs only two ping commands carrying readConcern.afterOpTime, which leave waiters behind that persist until restart, rollback or stepdown. The crash happens when that lagging member wins a later election, because the catch-up cleanup runs twice and touches memory already freed, so the new primary dies before accepting writes. Datadog's lab reproduction on 8.0.34 confirmed a segfault with no primary left, while 8.0.37 rejected the requests as unauthorized. Atlas clusters are patched automatically during maintenance, but self-managed deployments must upgrade every member and verify versions, and 8.2 reached end of life on July 31 so its users should plan a move rather than wait for a fix.
Why it matters
The flaw lets anyone on the network with access to a deployment take down a newly elected primary, which can leave a replica set without a working primary. Atlas customers are patched automatically during maintenance, so the exposure falls mainly on self-managed deployments that have not yet moved to fixed versions. Operators on the 8.2 branch cannot expect a fix there, since that branch no longer receives security updates. Until members are upgraded, restricting network access to the database reduces exposure but does not remove the flaw.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.