MongoDB fixes pre-auth crash bug in replica sets
Nov 12, 2026 · Summarized by Fundy Tech from The Hacker News
MongoDB fixed a critical flaw that lets an unauthenticated attacker crash a replica set member under the right failover conditions. Standalone mongod servers are not affected.
Key points
- CVE-2026-118383 affects replica set members and sharded clusters.
- Two requests can trigger a crash if the member later becomes primary.
- MongoDB says it found the flaw and saw no misuse.
Why it matters
If your business uses MongoDB, a failover at the wrong time could take a database offline. That can interrupt websites, orders, or internal tools. Households are less likely to run MongoDB directly, but many apps and services depend on it behind the scenes. Updating every member in the set matters, including systems that were offline during maintenance.
Who’s affected: MongoDB replica set and sharded cluster members
What to do
- Upgrade every replica set and shard member.
- Check containerised and offline members after maintenance.
- Restrict database access until you can patch.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.