MongoDB has released fixes for a critical flaw that lets an unauthenticated client leave a time bomb inside a replica set member.
The bug is CVE-2026-118383, a use-after-free that MongoDB scored 9.5 under CVSS 4.0. Datadog Security Labs reproduced the crash and published the mechanism.
Waiters that never expire
The attacker sends two ping commands carrying a readConcern.afterOpTime value. Each asks the server to hold until replication reaches a given point, and the server records a pending notification, called a waiter, for it.
Nothing happens yet. The waiters do not expire and survive until the member restarts, rolls back, or steps down from primary.
The damage comes later. If that member wins an election while still behind its peers, it applies the writes it missed, then runs cleanup. Cleanup executes twice and touches memory already released, so the new primary segfaults before accepting a single write.
Two requests accomplish this and need no credentials. Enabling authentication does not stop them.
Scope and the EOL branch
Shard and config server members of sharded clusters are exposed. A standalone mongod is not.
Atlas clusters receive fixed builds during maintenance, so deferring customers should pull the upgrade forward. Self-managed operators must confirm every member, including containerised ones and hosts that were offline during the window, is on a patched build.
One trap: branch 8.2 is absent from the affected list, but it reached end of life on July 31 and gets no security fixes. A lab proof of concept reports 8.2.12 still crashed.
Until every member is upgraded, restrict database network access to only the systems that require it.
