# MongoDB: replication flaw affects replica set members Canonical: https://www.oktsec.com/radar/mongodb-replication-cve-2026-118383 Publisher: Oktsec Language: en Published: 2026-11-12T12:27:20Z Updated: 2026-11-12T12:27:20Z Record reviewed: 2026-11-12T12:27:20Z Latest evidence check: 2026-11-12T12:27:20Z Disclosed: 2026-11-10 MongoDB reports a replication memory flaw that can crash replica set members or, under specific conditions, execute code through requests without authentication. Standalone mongod instances are outside the stated scope. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The vendor confirms a serious replication flaw and branch corrections. It requires a newly elected primary to complete catch-up; the reviewed sources do not establish attacks. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: MongoDB - Products: MongoDB Server - CVEs: CVE-2026-118383 - Vendor severity: CVSS 4.0 9.5 ## Technical overview The memory error occurs when a newly elected replica set primary completes catch-up. MongoDB says requests that do not require authentication can trigger the condition, terminating the server or, under certain conditions, executing code as the server process. The scope includes replica set members in ordinary deployments and the shard and config server replica sets of sharded clusters. Standalone mongod instances are not affected by this issue. MongoDB’s CVE record and the linked resolved engineering issues identify corrections in 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32. Match each deployment to its branch and supported upgrade procedure. The reviewed sources do not establish exploitation in attacks. Oktsec recommends verifying running versions across all members and checking replication health after updating. Restrict network access while planning the update; requiring database credentials does not remove a path triggered by requests without authentication. ## Recommended response Identify replica set members, including shards and config servers. Install the corrected version for each branch, verify running versions and restrict database access to trusted networks. Relevant to: Operators of MongoDB replica sets and sharded clusters, including shard and config server members. ## CVE attribution - CVE-2026-118383: MongoDB — MongoDB Server; CVSS 4.0: 9.5. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118383.json) ## Affected systems and fixes ### MongoDB Server 9.0 Affected: 9.0.0 up to but not including 9.0.7 when deployed as replica set members, including shards and config servers. Fixed release / action: 9.0.7 ### MongoDB Server 8.3 Affected: 8.3.0 up to but not including 8.3.16 when deployed as replica set members, including shards and config servers. Fixed release / action: 8.3.16 ### MongoDB Server 8.0 Affected: 8.0.0 up to but not including 8.0.37 when deployed as replica set members, including shards and config servers. Fixed release / action: 8.0.37 ### MongoDB Server 7.0 Affected: 7.0.0 up to but not including 7.0.48 when deployed as replica set members, including shards and config servers. Fixed release / action: 7.0.48 ### MongoDB Server 6.0 Affected: 6.0.0 up to but not including 6.0.30 when deployed as replica set members, including shards and config servers. Fixed release / action: 6.0.30 ### MongoDB Server 5.0 Affected: 5.0.0 up to but not including 5.0.35 when deployed as replica set members, including shards and config servers. Fixed release / action: 5.0.35 ### MongoDB Server 4.4 Affected: 4.4.0 up to but not including 4.4.32 when deployed as replica set members, including shards and config servers. Fixed release / action: 4.4.32 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-12T12:27:42.783Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-12T12:27:43.354Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-118383 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-12T12:27:43.354Z. ## Response checklist 1. **Identify replica set topology** — Inventory all members, including shard and config server replica sets. Standalone mongod instances are not affected by this CVE. Do not infer scope from the product name alone. 2. **Apply the branch correction** — Use the corrected release for each installed branch: 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32. Follow the supported upgrade procedure for your deployment. 3. **Verify running versions and replication health** — Oktsec recommends confirming the version on every member and checking replication and application health after the update. Updating an image or package alone does not verify the active server. 4. **Review database network access** — Oktsec recommends limiting database connections to trusted networks and investigating unexplained terminations. Authentication alone does not prevent the requests described by the vendor. ## Relevance to AI environments Include databases used by applications and agent workflows in the replica set inventory; deployment topology determines applicability. ## Sources - [MongoDB CNA: CVE-2026-118383 topology, versions and impact](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118383.json) — MongoDB; Vendor notice; checked 2026-11-12T12:27:20Z - [MongoDB SERVER-138119: corrected branches](https://jira.mongodb.org/browse/SERVER-138119) — MongoDB; Vendor notice; checked 2026-11-12T12:27:20Z - [MongoDB SERVER-138175: replication memory correction](https://jira.mongodb.org/browse/SERVER-138175) — MongoDB; Vendor notice; checked 2026-11-12T12:27:20Z ## Editorial record - 2026-11-12T12:27:20Z: Added verified vendor scope, response actions and the limits of the available evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/mongodb-replication-cve-2026-118383) · [Build a response plan](https://www.oktsec.com/radar/mongodb-replication-cve-2026-118383#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=mongodb-replication-cve-2026-118383&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=mongodb-replication-cve-2026-118383&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.