MongoDB fixes 26 security flaws across Server versions

MongoDB has released version 9.0.7 alongside six maintenance updates to fix a total of 26 security bugs in MongoDB Server. The standout issues, CVE-2026-118383 with CVSS 9.5 and CVE-2026-120808 with CVSS 9.1, could enable attackers to execute code, snoop on traffic, or cause crashes. The patch notes flag that these flaws affect replica set primary catch-up and the macOS TLS stack, respectively, with the most dangerous scenario arising when a newly elected replica set primary finishes its catch-up step.

Neither report of active exploitation is confirmed at this time, but the bugs pose a significant risk to stored data if left unpatched.

The affected versions span MongoDB Server branches 9.0 before 9.0.7, 8.3 before 8.3.16, 8.0 before 8.0.37, and 7.0 before 7.0.48, with CVE-2026-118383 and CVE-2026-120828 also impacting older branches 6.0 before 6.0.30, 5.0 before 5.0.35, and 4.4 before 4.4.32. In addition to the two lead vulnerabilities, the release notes list multiple use-after-free and authorization-related flaws across time-series, query, and encryption components.

MongoDB urges administrators to update to the fixed versions (9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, or 4.4.32) and to audit user roles after any role changes.