Two Planted Pings Can Knock Out a Freshly Elected MongoDB Primary

On November 10, 2026, MongoDB shipped fixes for CVE-2026-118383, a use-after-free in its server’s replication code scored CVSS 9.5 (Critical) under CVSS 4.0. Only replica set members are exposed, including shard and config server members of sharded clusters. Standalone mongod instances are safe. MongoDB spotted the bug internally and reports no known exploitation attempts.

Datadog Security Labs showed on November 11 that a client with no credentials can send two ping commands carrying a readConcern.afterOpTime value, and turning on authentication won’t block them. They lie dormant until that member wins an election while behind on replication, which an attacker can’t force. Cleanup then runs twice, and version 8.0.34 crashed in testing. MongoDB warns code execution is possible in some conditions, though Datadog didn’t achieve it.

Patched releases are 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32. The 8.2 branch, out of support since July 31, 2026, gets no fix, and a public proof of concept reports 8.2.12 still shows the bug in a lab using a test-only setting. Atlas clusters update during maintenance. Self-hosted teams should upgrade every member and restrict network access until then.

Source: The Hacker News