CVE-2026-118383

Summary

A use-after-free vulnerability exists in MongoDB Server's replication component, triggered when a newly elected primary completes catch-up. This flaw can cause server crashes or potentially arbitrary code execution due to improper memory handling during replica set operations.

Exploitability

Exploitation requires high skill and specific conditions: unauthenticated network requests must be crafted to trigger the race condition during primary election and catch-up, and success is not guaranteed.

Blast radius

If exploited, attackers could crash MongoDB services or gain code execution as the server process, affecting all replica set members—including shard and config servers in sharded clusters—potentially compromising entire database infrastructures.

Detection

Defenders should monitor for unexpected mongod process termination during replica set primary elections or catch-up phases, especially when accompanied by replication-related error logs such as 'E11000 duplicate key error' or 'Cannot find record' messages in the oplog; no reliable network or authentication-based indicators are described.

Prioritized remediation

Upgrade to MongoDB Server version 6.0.17, 7.0.12, or 8.0.3 (or later patch releases for those major versions), as these contain the fix for CVE-2026-118383.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.