CVE-2026-118383

What it is. Per MongoDB, the flaw is in the replication component and can occur when a newly elected replica set primary completes catch-up. Requests that need no authentication can cause it. MongoDB says the result may be the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.

Affected, per MongoDB. MongoDB Server 9.0.0 before 9.0.7, 8.3.0 before 8.3.16, 8.0.0 before 8.0.37, 7.0.0 before 7.0.48, 6.0.0 before 6.0.30, 5.0.0 before 5.0.35 and 4.4.0 before 4.4.32, when the server is a replica set member. That includes the shard and config server replica sets of sharded clusters. Standalone mongod instances are not affected.

MongoDB 8.2. MongoDB's advisory does not list 8.2. The public proof of concept reports a crash on 8.2.12. If you run 8.2, ask MongoDB which build includes the fix.

Managed services. MongoDB's advisory covers MongoDB Server and does not mention MongoDB Atlas.

Checks, in three tiers. The first two decide exposure. The third decides priority. Run these only on systems your organization owns.

1. Is the server a replica set member? Run rs.status() in mongosh, or check the configuration file for a replication.replSetName setting or the --replSet startup option. Include the shard and config servers of sharded clusters. A standalone mongod is out of scope.
2. Is it running an affected build? Run db.version() in mongosh or mongod --version on the host, and compare against the fixed versions above. Check container images and package versions too, since a fixed package does nothing until mongod restarts on it.
3. Can untrusted networks reach it? MongoDB listens on port 27017 by default. Check the net.bindIp setting and test from the networks you care about whether the port answers. A replica set member reachable from the internet or from user networks goes first.

Identities involved. MongoDB says code execution, if achieved, would run in the context of the server process. Check what the mongod service account and host can reach, including the data on that replica set and any credentials stored on the host.

MongoDB has published no workaround for CVE-2026-118383. Upgrading to a fixed version is the fix.

MongoDB has published no indicators of compromise. General signals to review on replica set members are below.

• Unexpected mongod crashes or restarts, especially around primary elections.
• Connections to the MongoDB port from sources outside your application and operator networks.
• Process activity from the mongod service account that your workloads do not explain, such as unexpected child processes or outbound connections.

Am I exposed to CVE-2026-118383?

You may be if you run MongoDB Server as a replica set member on a version before 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32, and untrusted networks can reach it. No login is needed, per MongoDB. Standalone mongod is not affected.

Is CVE-2026-118383 being exploited?

No exploitation has been reported, and it is not on CISA KEV as of the November 10, 2026 catalog. Public code posted November 11 crashes test replica sets; it does not show code execution.

Is there a patch for CVE-2026-118383?

Yes. MongoDB fixed it in 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32.

What about MongoDB 8.2?

MongoDB's advisory does not list 8.2. The public proof of concept reports a crash on 8.2.12. If you run 8.2, ask MongoDB which build includes the fix.

Is there a workaround?

MongoDB has published none. Upgrading is the fix.

Nov 11, 2026. First published. MongoDB fixed the flaw in seven release lines and published the CVE on November 10; public code crashes test replica sets; no exploitation reported; not on CISA KEV.

• MongoDB security alerts, CVE-2026-118383 (Nov 10, 2026)
• CVE record CVE-2026-118383 (CNA MongoDB, published Nov 10, 2026)
• MongoDB tickets SERVER-138175 and SERVER-138119 (fixed versions)
• NIST NVD: CVE-2026-118383 (no NVD score, checked Nov 11)
• Public proof of concept, googlesky/CVE-2026-118383 (posted Nov 11, 2026; read only, not run)
• MongoDB docs, IP binding
• CISA Known Exploited Vulnerabilities catalog (not listed; checked catalog version 2026.11.10)