External risk intelligence

MongoDB Replication Use-After-Free Leading to Server Termination or Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-118383

This vulnerability affects the replication component of MongoDB Server, specifically for replica set members. MongoDB databases are typically deployed within internal, protected network segments and are not intended to be exposed directly to the public internet. While network-reachable in some internal environments, public internet exposure is uncommon and generally considered a misconfiguration.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in MongoDB Server's replication component, potentially allowing for unexpected server termination or code execution. The issue arises during the catch-up process of a newly elected primary in a replica set, and it can be triggered by unauthenticated requests. While standalone instances are unaffected, this vulnerability impacts replica set members within sharded clusters, including shard and config servers. The main concern is confirming relevance and exposure given that MongoDB is typically run in protected internal networks.

Software can unexpectedly stop or execute code.
Affects MongoDB replica sets, not standalone systems.
Confirm relevance and potential impact within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerable MongoDB Server through network requests that do not require authentication. If a replica set primary is in the process of catching up, these requests could trigger a use-after-free condition within the replication component. This may lead to the server crashing or, in some scenarios, arbitrary code execution.

Network access required.
Triggered during primary catch-up.
May cause server termination or code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in MongoDB Server's replication component could lead to unexpected server termination or, in supported configurations, arbitrary code execution. This occurs when a newly elected replica set primary performs a catch-up operation, potentially triggered by unauthenticated requests. Only replica set members are affected, not standalone instances.

Replica set members could be terminated.
Unauthenticated requests may trigger the flaw.
Arbitrary code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The replication component of MongoDB Server is susceptible to a use-after-free vulnerability when an elected primary completes catch-up, potentially leading to unexpected termination or arbitrary code execution. Given that replica set members are affected, including sharded cluster components, the primary owners are likely the database administration or platform teams responsible for MongoDB deployments. The initial step should be to inventory all MongoDB replica sets, confirm network reachability and business criticality, identify the accountable owner, and then plan remediation, coordinating with vendor management if necessary.

Database or platform teams should own.
Verify replication set reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MongoDB Server and its replication component?

MongoDB Server is a popular document-oriented database system designed for high availability and scalability. The replication component is a fundamental feature that allows data to be synchronized across multiple servers, known as replica sets. This ensures that if one server fails, another can take over, maintaining continuous operation of the database cluster.

What does a use-after-free vulnerability mean in CVE-2026-118383?

This vulnerability is classified as CWE-416, a use-after-free weakness. It occurs when a program continues to use a memory address after that memory has been cleared or released. In this specific CVE, the replication component fails to properly manage memory during the catch-up process, which can cause the server to crash or potentially allow unauthorized code to execute.

How is the replication flaw triggered?

The issue is triggered when a newly elected replica set primary completes a catch-up operation. An attacker can initiate this by sending specific network requests that do not require authentication. It is important to note that standalone MongoDB instances are not susceptible to this flaw, as the vulnerability is specific to the complex interactions within a replica set.

Do I need to worry about this if my MongoDB is internal?

Halo Surface Signal assesses this as unlikely to be internet-exposed, as databases are typically kept in protected, private network segments. However, the risk remains if the replica set is reachable over your internal network. You should prioritize assets where replica sets are used, as these are the configurations specifically affected by this vulnerability.

What are the first steps to address this CVE?

Start by performing an inventory of your environment to identify all MongoDB replica sets and sharded cluster components. Confirm the network reachability of these instances and determine their business criticality. Once mapped, coordinate with your database or platform administration teams to plan and apply the necessary updates or mitigations provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.