Interfaz en español. Las fichas, los resúmenes y las fuentes conservan su idioma original.
MongoDB reports a replication memory flaw that can crash replica set members or, under specific conditions, execute code through requests without authentication. Standalone mongod instances are outside the stated scope.
Quiénes deben revisar: Operators of MongoDB replica sets and sharded clusters, including shard and config server members.
Identify replica set members, including shards and config servers. Install the corrected version for each branch, verify running versions and restrict database access to trusted networks.
The memory error occurs when a newly elected replica set primary completes catch-up. MongoDB says requests that do not require authentication can trigger the condition, terminating the server or, under certain conditions, executing code as the server process.
The scope includes replica set members in ordinary deployments and the shard and config server replica sets of sharded clusters. Standalone mongod instances are not affected by this issue.
MongoDB’s CVE record and the linked resolved engineering issues identify corrections in 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32. Match each deployment to its branch and supported upgrade procedure. The reviewed sources do not establish exploitation in attacks.
Oktsec recommends verifying running versions across all members and checking replication health after updating. Restrict network access while planning the update; requiring database credentials does not remove a path triggered by requests without authentication.
| Producto | Afectado | Versión corregida / acción |
|---|---|---|
| MongoDB Server 9.0 | 9.0.0 up to but not including 9.0.7 when deployed as replica set members, including shards and config servers. | 9.0.7 |
| MongoDB Server 8.3 | 8.3.0 up to but not including 8.3.16 when deployed as replica set members, including shards and config servers. | 8.3.16 |
| MongoDB Server 8.0 | 8.0.0 up to but not including 8.0.37 when deployed as replica set members, including shards and config servers. | 8.0.37 |
| MongoDB Server 7.0 | 7.0.0 up to but not including 7.0.48 when deployed as replica set members, including shards and config servers. | 7.0.48 |
| MongoDB Server 6.0 | 6.0.0 up to but not including 6.0.30 when deployed as replica set members, including shards and config servers. | 6.0.30 |
| MongoDB Server 5.0 | 5.0.0 up to but not including 5.0.35 when deployed as replica set members, including shards and config servers. | 5.0.35 |
| MongoDB Server 4.4 | 4.4.0 up to but not including 4.4.32 when deployed as replica set members, including shards and config servers. | 4.4.32 |
Usá las indicaciones para tu producto y rama. Confirmá con el proveedor las correcciones adaptadas a tu distribución; el nombre del producto por sí solo no establece exposición.
The vendor confirms a serious replication flaw and branch corrections. It requires a newly elected primary to complete catch-up; the reviewed sources do not establish attacks.
Include databases used by applications and agent workflows in the replica set inventory; deployment topology determines applicability.
Added verified vendor scope, response actions and the limits of the available evidence.
Usá esta lista para evaluar si el aviso afecta a tus sistemas, registrar las acciones de tu equipo y compartir el resultado. Radar no escanea ni verifica tu entorno.
Los cambios se guardan automáticamente en este navegador. No se sincronizan con tu equipo ni se envían a Oktsec.
Revisá los sistemas y versiones afectados y registrá tu decisión a continuación. Si tenés dudas, elegí «Requiere verificación».
Indicá el sistema y la persona o equipo responsable. Actualizá cada acción y agregá una referencia al ticket o notas sobre lo revisado.
Inventory all members, including shard and config server replica sets. Standalone mongod instances are not affected by this CVE. Do not infer scope from the product name alone.
Use the corrected release for each installed branch: 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32. Follow the supported upgrade procedure for your deployment.
Oktsec recommends confirming the version on every member and checking replication and application health after the update. Updating an image or package alone does not verify the active server.
Oktsec recommends limiting database connections to trusted networks and investigating unexplained terminations. Authentication alone does not prevent the requests described by the vendor.
Descargá un archivo Markdown con tu decisión, los estados de las acciones, las notas y las fuentes. Compartilo con tu equipo o adjuntalo a un ticket.
Compará la versión en ejecución y la configuración con las indicaciones del proveedor.
| Producto | Afectado | Versión corregida / acción |
|---|---|---|
| MongoDB Server 9.0 | 9.0.0 up to but not including 9.0.7 when deployed as replica set members, including shards and config servers. | 9.0.7 |
| MongoDB Server 8.3 | 8.3.0 up to but not including 8.3.16 when deployed as replica set members, including shards and config servers. | 8.3.16 |
| MongoDB Server 8.0 | 8.0.0 up to but not including 8.0.37 when deployed as replica set members, including shards and config servers. | 8.0.37 |
| MongoDB Server 7.0 | 7.0.0 up to but not including 7.0.48 when deployed as replica set members, including shards and config servers. | 7.0.48 |
| MongoDB Server 6.0 | 6.0.0 up to but not including 6.0.30 when deployed as replica set members, including shards and config servers. | 6.0.30 |
| MongoDB Server 5.0 | 5.0.0 up to but not including 5.0.35 when deployed as replica set members, including shards and config servers. | 5.0.35 |
| MongoDB Server 4.4 | 4.4.0 up to but not including 4.4.32 when deployed as replica set members, including shards and config servers. | 4.4.32 |
Confirmá con el proveedor las correcciones adaptadas a tu distribución. Coincidir en el producto no basta para establecer exposición.
The vendor confirms a serious replication flaw and branch corrections. It requires a newly elected primary to complete catch-up; the reviewed sources do not establish attacks.
Criterios de prioridadCatálogo 2026.11.10 · Revisado 12 nov 2026 UTC
No hay un CVE coincidente en el corte del catálogo revisado. Esto no demuestra ausencia de explotación. Revisá las fuentes del incidente y las indicaciones del proveedor.
| Producto / CVE | Evidencia de ataques | Indicaciones de la fuente |
|---|---|---|
| MongoDB ServerCVE-2026-118383 | Ataques no establecidos La evidencia revisada no establece si esta vulnerabilidad se usó en ataques. | MongoDB fuenteRevisar sistemas afectados |
Estimación no disponible. No equivale a un puntaje de cero.
FIRST EPSS · Revisado 2026-11-12 12:27 UTC
La prioridad corresponde al aviso, no a cada producto o CVE por separado. Cada fila muestra solo la evidencia atribuida a ese CVE. La falta de evidencia de ataques no permite descartar una vulnerabilidad. Tu entorno no fue escaneado.
Los datos técnicos provienen de estas fuentes. Las prioridades y las acciones recomendadas son el análisis de Oktsec.
| Producto / servicio | MongoDB ServerMongoDB |
|---|---|
| CVE | CVE-2026-118383 |
| Evidencia de explotación | Ataques no establecidos |
| Acceso necesario | Depende de la aplicación o configuración |
| Severidad del proveedor | 9.5CVSS 4.0 |
| Severidad por CVE | CVE-2026-118383 · 9.5 · CVSS 4.0 |
| Corrección / respuesta | Corrección disponibleVersiones afectadas y correcciones |
Include databases used by applications and agent workflows in the replica set inventory; deployment topology determines applicability.