Datadog researchers detail MongoDB flaw that can crash servers

MongoDB has disclosed a critical pre-authentication vulnerability, CVE-2026-118383, that can cause a crash on a primary when a failover occurs in a replica set. The flaw, described as a use-after-free bug, can be triggered by two unauthenticated ping requests carrying a readConcern[.]afterOpTime value; on vulnerable versions, authentication does not stop these requests.

Datadog Security Labs reproduced the crash in a lab and observed that the crash occurs when a member that previously lagged wins an election and the catch‑up cleanup runs twice, reusing memory that had already been freed. MongoDB has released fixed releases for affected branches, and the crash could, under certain conditions, lead to arbitrary code execution in the server process, though the researchers did not observe code execution in their tests.

The vulnerability is present on replica set members including shard and config servers in sharded clusters; standalone mongod deployments are not affected.

Evidence and fixes were provided by MongoDB and the Datadog researchers. In their lab tests, on version 8.0.34 the member crashed with a segmentation fault; the fixed version 8.0.37 rejects the two requests as unauthorized and keeps the member running. The 8.2 branch is not listed among affected versions, with the newest 8.2.12, though a PoC published on GitHub reportedly showed the bug in a lab using a test-only setting.

MongoDB Atlas clusters receive fixed versions during maintenance, while self‑managed deployments must upgrade every replica set member. The company notes that end-of-life status for the 8.2 branch means no further fixes are provided, and guidance includes restricting network access to limit exposure until upgrades can be applied.

The PoC and technical analyses describe the waiter mechanism and the post‑catch‑up cleanup that leads to the crash, and the fixed release prevents both requests from being accepted in a single unauthorized step.