A critical vulnerability identified as CVE-2026-118383 has been discovered in MongoDB Server. This flaw allows an unauthenticated attacker to send two requests that can trigger a crash on the database server.
The vulnerability is a use-after-free issue affecting replica set members, including those used by shards and config servers. It has been assigned a CVSS score of 9.5, indicating its severity.
MongoDB has released fixed versions to address this issue and strongly recommends users upgrade their systems immediately. Despite the flaw, MongoDB has stated that it is not aware of any attempts to exploit this vulnerability.
The flaw can be exploited by sending two ping requests, causing a replica set member to crash during a failover. This occurs when the member receiving the requests wins an election while being behind another member.
Turning on authentication does not mitigate the risk of exploitation. The vulnerability was discovered internally by MongoDB's security program, and a proof of concept was published on GitHub on November 11, 2026.