---
title: Two Planted Pings Can Knock Out a Freshly Elected MongoDB Primary
description: MongoDB has patched a critical replication bug that clients without credentials can set off, hitting replica sets but sparing standalone servers.
canonical_url: https://codekeeper.co/ticker/two-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities) | [Software security](https://codekeeper.co/ticker/tag/software-security)

# Two Planted Pings Can Knock Out a Freshly Elected MongoDB Primary

MongoDB has patched a critical replication bug that clients without credentials can set off, hitting replica sets but sparing standalone servers.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 13, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

On November 10, 2026, MongoDB shipped fixes for CVE-2026-118383, a use-after-free in its server’s replication code scored CVSS 9.5 (Critical) under CVSS 4.0. Only replica set members are exposed, including shard and config server members of sharded clusters. Standalone mongod instances are safe. MongoDB spotted the bug internally and reports no known exploitation attempts. Datadog Security Labs showed on November 11 that a client with no credentials can send two ping commands carrying a readConcern.afterOpTime value, and turning on authentication won’t block them. They lie dormant until that member wins an election while behind on replication, which an attacker can’t force. Cleanup then runs twice, and version 8.0.34 crashed in testing. MongoDB warns code execution is possible in some conditions, though Datadog didn’t achieve it. Patched releases are 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32. The 8.2 branch, out of support since July 31, 2026, gets no fix, and a public proof of concept reports 8.2.12 still shows the bug in a lab using a test-only setting. Atlas clusters update during maintenance. Self-hosted teams should upgrade every member and restrict network access until then. Source: [The Hacker News](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftwo-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns Nov 13, 2026](https://codekeeper.co/ticker/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns)

[Vulnerabilities Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug Nov 10, 2026](https://codekeeper.co/ticker/feds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug)

[Vulnerabilities Jailbroken DeepSeek Agent Ran a Telecom Hack Mostly Unsupervised Nov 10, 2026](https://codekeeper.co/ticker/jailbroken-deepseek-agent-ran-a-telecom-hack-mostly-unsupervised)

[Vulnerabilities SonicWall Warns of Actively Exploited SSLVPN Flaw That Can Bypass MFA Nov 9, 2026](https://codekeeper.co/ticker/sonicwall-warns-of-actively-exploited-sslvpn-flaw-that-can-bypass-mfa)