CVE-2026-118383 is a vulnerability in MongoDB
Published on November 10, 2026
Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
Vulnerability Analysis
CVE-2026-118383 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-118383 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-118383
Want to know whenever a new CVE is published for MongoDB? stack.watch will email you.
Affected Versions
MongoDB Server:- Version 9.0.0 and below 9.0.7 is affected.
- Version 8.3.0 and below 8.3.16 is affected.
- Version 8.0.0 and below 8.0.37 is affected.
- Version 7.0.0 and below 7.0.48 is affected.
- Version 6.0.0 and below 6.0.30 is affected.
- Version 5.0.0 and below 5.0.35 is affected.
- Version 4.4.0 and below 4.4.32 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.