MongoDB · Disclosed

MongoDB: unauthenticated flaw causes crashes; patch recommended

Nov 12, 2026 · 1 min read

CVE-2026-118383 can crash MongoDB through unauthenticated requests during replica-set failover. DailyDarkWeb reports that Datadog reproduced the crash but did not demonstrate the potential code execution. Patch every replica-set member.

By HIFY Radar newsroom Updated 11/12/2026 06:52 AM Get this every day →← Back to the feed 3 sources

HighVulnerabilityDisclosedPatched

In 30 seconds

Alleged

Fixed MongoDB Server versions are available for CVE-2026-118383, a critical pre-authentication flaw reported to let two unauthenticated requests prepare a replica-set member to crash if it later takes over during failover while missing recent changes. Operators should update every replica-set member.

What happened

Alleged

The Hacker News reports that an attacker does not need an account and can use two requests to trigger the vulnerable condition. The crash is not described as immediate: it occurs if the targeted member is subsequently selected as the main server while still behind on recent changes.

Alleged

DailyDarkWeb says Datadog reproduced the crash with unauthenticated requests during replica-set failover. The supplied Datadog evidence points to a dedicated analysis of CVE-2026-118383, but contains no article text with which to independently check that account.

Why it matters

Inferred

A remotely induced database crash can threaten availability, especially during failover, the moment designed to keep a replica set running after its main member changes. Requiring no authentication and only two requests would make the reported trigger comparatively easy to reach where MongoDB is network-accessible.

Alleged

DailyDarkWeb also attributes potential code execution to the flaw under certain conditions, which would be more serious than a crash. Its summary explicitly says the cited test did not demonstrate code execution, so that outcome remains unverified in this evidence.

What to do

Inferred

Apply a fixed MongoDB Server version to every member of each replica set, not only the current main member. This matters because another member can later be selected during failover and encounter the reported crash condition.

Inferred

The supplied evidence does not list affected or fixed release numbers. Administrators therefore need to verify their deployed version against MongoDB's release information before treating an installation as patched.

Confirmed and still uncertain

Alleged

The evidence consistently describes an unauthenticated, two-request path associated with a later crash during a specific replica-set failover condition, and reports that fixed versions have been released.

Observed

The supplied material does not establish successful code execution, identify affected version ranges, describe exploitation in the wild, or quantify how many deployments are exposed. It also does not provide the complete Datadog analysis or a MongoDB advisory.

What people are saying

Observed

The Hacker News characterizes CVE-2026-118383 as a critical pre-authentication flaw and says patches are available. DailyDarkWeb emphasizes the reported Datadog crash reproduction, while warning that the test did not prove the more severe code-execution possibility.

Evolution

Alleged

The reported sequence begins with two unauthenticated requests. A targeted replica-set member then remains in a vulnerable state, and the crash emerges only later if that lagging member is chosen to take over as the main server. Publication of fixed versions changes the immediate priority from assessing the report to patching the full replica set.

Reach

Observed

2 independent groups, 3 updates, and 3 engagements.

Technical detail

Alleged

This is described as a conditional failure rather than a simple request-and-crash bug. The attacker allegedly sends two unauthenticated requests, but the crash requires the affected replica-set member to be behind on recent changes and later selected as the main server during failover.

Alleged

One discussion post assigns a CVSS score of 9.5. Another says code execution may be possible under certain conditions, but also says the reported reproduction reached only a crash. The evidence therefore supports treating code execution as a possibility claimed by a third party, not a demonstrated result.

Sources and evidence

Observed

The most detailed supplied account is The Hacker News's report, which provides the trigger, failover condition and existence of fixed versions. DailyDarkWeb supplies the reproduction and standalone-instance claims. A Datadog Security Labs URL is present as a primary source, but its title and body are absent from the evidence, limiting direct verification of its technical findings.