MongoDB has patched a critical vulnerability, CVE-2026-118383, that allows unauthenticated users to crash database servers in replica sets during failover scenarios. The flaw is a use-after-free bug that manifests when a server member, lagging behind in replication, becomes primary and triggers cleanup routines that act on memory already freed.
In MongoDB’s standard architecture, a replica set consists of a primary node accepting writes and secondary nodes that replicate data. If the primary goes down, a new one is elected among secondaries. Researchers at Datadog Security Labs found that when two special ping commands—each carrying a readConcern.afterOpTime value—are sent to a lagging member, they set up “waiters” (pending notifications). When that member later wins an election while still behind, it enters a catch-up phase. Once catching up, the cleanup process runs twice, leading to memory being recycled incorrectly and a crash before the node can resume handling writes.
Affected Versions & Patch Details
The flaw impacts shard and config server members in sharded clusters, but not standalone mongod instances. MongoDB scores the bug 9.5/10 on the CVSS 4.0 severity scale. The issue affects every release in vulnerable branches until patched versions:
- In the 8.0 branch, versions up to 8.0.36 are vulnerable; version 8.0.37 resolves the issue.
- The 8.2 branch, while labeled end-of-life as of July 31, remains vulnerable; even its latest release (8.2.12) reproduces the bug under test lab conditions.
For managed deployments, like MongoDB Atlas, the fix has already been rolled out via maintenance windows. Self-managed setups must upgrade every replica set member to the patched versions, including any that were offline or containerized during maintenance. After upgrading, verify each node’s version to ensure full protection.
Mitigations & Detection
Until all members are upgraded, administrators should restrict network exposure so only trusted systems can send commands to the database. This won’t block the vulnerability completely but limits potential attack sources.
Signs of exploitation include specific log entries: unauthenticated ping requests with readConcern.afterOpTime that time out (marked as “Slow query” with MaxTimeMSExpired), followed by events where a node enters and exits primary catch-up twice during an election, and finally a fatal signal or backtrace involving cleanup routines. If gathered, such logs suggest the use-after-free crash pattern.
While the bug can cause crashes or memory corruption, no confirmed remote code execution has been observed in lab setups. MongoDB indicates, however, that certain configurations *could* lead to code execution under conditions not yet demonstrated.
This flaw affects servers with authentication turned off just as easily as those with it on, since the setup of waiters isn’t blocked by the auth requirement. One part of the fix now enforces that only system users may use readConcern.afterOpTime, and another prevents the cleanup routine from executing twice when waiters are still present.
Administrators can review structured logs for the following patterns:
- Commands labeled “Slow query” (ID 51803) for unauthenticated ping requests with
readConcern.afterOpTimethat end via timeout. - A member entering primary catch-up (ID 21359), exiting it twice (ID 21363) during a single election.
- A fatal signal or backtrace involving the cleanup or “CatchupState::abort_inlock()” following the double exit.
Deployments running test-only settings may help reproduce the issue reliably, but remote attackers generally cannot force those settings. All logged detection relies heavily on logging configuration and whether certain fields are recorded.
**Why this matters:** This CVE highlights that even when unauthorized, clients may trigger severe behavior in databases that manage leader election and state synchronization. For teams relying on replica sets and failover redundancy, a single lagging node left unpatched can bring down cluster availability.
