MongoDB said on November 10 that it released a fix for a critical flaw it found itself. It knew of no attacks then. Tracked as CVE-2026-118383, the bug scores 9.5 on the CVSS v4.0 scale. It is a use-after-free: the server reuses memory it already freed. It affects replica set members, including shard and config server members. Standalone mongod servers are not affected.
Datadog Security Labs explained the setup on November 11. Vulnerable servers accept ping requests before login, so authentication does not block this step. Two pings carrying a readConcern.afterOpTime value leave stale waiters, pending notifications, on a member. If that member later wins an election while behind, it catches up on missed writes. Its cleanup then runs twice, and the second run touches freed memory. Datadog crashed a lab server on MongoDB 8.0.34 but created the lag and failover itself. It did not get code execution. MongoDB says that is possible under certain conditions. Fixed version numbers are not listed.
An attacker can plant the condition but cannot trigger it. The planted state stays until a restart, rollback or step-down, so your maintenance or outage may set it off. Ask which replica sets nobody has verified, and who checks versions on containers and offline members. MongoDB urges Atlas customers who put off maintenance to upgrade promptly.