Skip to content
OpenAdvisories
Critical · 9.0 Public exploit CVE-2026-118383 EUVD-2026-122846GHSA-fjxh-6vgh-cx2c

Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by mongodb

Vendor: MongoDB Product: MongoDB Server

Description

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 9.0.0 – < 9.0.7, 8.3.0 – < 8.3.16, 8.0.0 – < 8.0.37, 7.0.0 – < 7.0.48, 6.0.0 – < 6.0.30, 5.0.0 – < 5.0.35, 4.4.0 – < 4.4.32 9.0.7

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • googlesky/CVE-2026-118383 ★ 2 · Nov 11, 2026

    PoC for CVE-2026-118383 — MongoDB unauthenticated use-after-free in ReplicationCoordinatorImpl::CatchupState during primary catch-up via readConcern.afterOpTime waiter poisoning, with deterministic c…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References