{"id":"CVE-2026-118383","published":"2026-11-10T21:18:58.980","lastModified":"2026-11-10T22:08:59.707","description":"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-138119","tags":[]},{"url":"https://jira.mongodb.org/browse/SERVER-138175","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability exists in MongoDB Server's replication component, triggered when a newly elected primary completes catch-up. This flaw can cause server crashes or potentially arbitrary code execution due to improper memory handling during replica set operations.","exploitability":"Exploitation requires high skill and specific conditions: unauthenticated network requests must be crafted to trigger the race condition during primary election and catch-up, and success is not guaranteed.","blast_radius":"If exploited, attackers could crash MongoDB services or gain code execution as the server process, affecting all replica set members—including shard and config servers in sharded clusters—potentially compromising entire database infrastructures.","remediation":"Upgrade to MongoDB Server version 6.0.17, 7.0.12, or 8.0.3 (or later patch releases for those major versions), as these contain the fix for CVE-2026-118383.","detection":"Defenders should monitor for unexpected mongod process termination during replica set primary elections or catch-up phases, especially when accompanied by replication-related error logs such as 'E11000 duplicate key error' or 'Cannot find record' messages in the oplog; no reliable network or authentication-based indicators are described.","tags":["use-after-free","rce","replication","mongodb","crash","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:59:40.636Z"}}