CyberSecurity News

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

The Hacker News

· November 12, 2026

AI summary

A critical vulnerability in MongoDB Server can be exploited by an unauthenticated attacker to crash a database server. This occurs when the server, which is a member of a replica set, is chosen to take over as the primary server while missing some recent updates. The attacker can trigger the crash by sending two specific requests. MongoDB has released updated versions to address the issue. The vulnerability is specifically relevant to servers that are part of a replica set and may be selected to become the primary server during a failover. Affected servers can be crashed if they have not yet received all recent changes.

Vulnerabilities mentioned

CVE-2026-118383

CRITICAL

CVSS 9

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.

Read the full article at The Hacker Newsthehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.