Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
A newly disclosed flaw can enable an attacker to execute their own code on systems running MongoDB, granting full control.
A newly disclosed flaw can hand an attacker the ability to run their own code on systems running MongoDB -- not a minor bug, the kind that gets full control.
The affected service is reachable from the network without authentication.
MongoDB may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
MongoDB, the company that makes the database, released fixed versions earlier this week.
One member, the primary, serves as the main server and handles all new writes, while the others replicate them.
If the primary becomes unavailable, the other members hold an election to pick a new primary.
Anyone running MongoDB 8.0.34 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server.
The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Being reachable without authentication is what moves this from 'patch eventually' to 'patch now' -- there's no login screen standing between an attacker and the vulnerable code.
The affected servers are members of a replica set, a group of MongoDB servers that keep copies of the same data.
This is tracked as CVE-2026-118383 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are 8.0.34, so that's the range to check against your own deployment.
On vulnerable versions, turning on authentication does not stop the two requests.
A fix for MongoDB is already available, so upgrading is the direct remediation here.
Each affected branch has a fixed release, listed below and in the CVE record.
Every earlier version in a branch is affected, back to the branch's first release.
Confirm whether MongoDB 8.0.34 is present anywhere in your asset and software inventory.
Confirm the fixed version is actually deployed across affected assets, not just scheduled.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
A newly disclosed flaw can enable an attacker to execute their own code on systems running MongoDB, granting full control.
The affected service is accessible from the network without authentication.
MongoDB may already be functioning normally in your environment while also being reachable from a network that an attacker can access.
What changed
MongoDB, the company behind the database, released fixed versions earlier this week.
In a replica set, one member, the primary, serves as the main server and manages all new writes, while the others replicate them.
If the primary becomes unavailable, the other members hold an election to select a new primary.
Who is affected
Anyone running MongoDB 8.0.34 is at risk, and since this is accessible without authentication, exposure does not rely on user actions.
A critical flaw in MongoDB Server permits an unauthenticated attacker to send two requests that trigger a crash on the database server.
The crash occurs only if that server is later selected to take over as the primary while still missing some recent changes.
Why it matters
The successful exploitation allows the attacker to execute code with the permissions of the affected process.
The lack of authentication elevates this issue from 'patch eventually' to 'patch now'—there's no login screen between an attacker and the vulnerable code.
The affected servers are part of a replica set, a group of MongoDB servers that maintain copies of the same data.
Technical details
This vulnerability is tracked as CVE-2026-118383 and rated critical severity, which is the identifier to reference when consulting vendor guidance.
The affected version is 8.0.34, so that is the range to verify against your own deployment.
On vulnerable versions, enabling authentication does not prevent the two requests.
Response
A fix for MongoDB is already available, making upgrading the direct remediation.
Each affected branch has a fixed release, which is listed below and in the CVE record.
Every earlier version in a branch is vulnerable, back to the branch's initial release.
What security teams should do
Verify whether MongoDB 8.0.34 is present in your asset and software inventory.
Ensure the fixed version is deployed across affected assets, rather than just scheduled.