CVE-2026-118383: Critical MongoDB Server Pre-Auth Crash Flaw

# CVE-2026-118383: Critical MongoDB Server Pre-Auth Crash Flaw

https://gcdradar.vercel.app/incidents/cve-2026-118383-critical-mongodb-server-pre-auth-crash-flaw · AIR-2026-1923 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical rating with a fix provided and no exploitation reported.
- Fix status: Patched
- First reported: 2026-11-12
- AI role: No AI role
- Products: MongoDB Server
- CVE ids: CVE-2026-118383
- CVSS: 9

## Summary

A critical pre-authentication vulnerability in MongoDB Server allows unauthenticated attackers to crash lagging replica servers during failover events. The vendor has released patches to address the issue.

## What to do

Update MongoDB Server to the latest fixed version.

## Latest updates

- 2026-11-12: Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover (https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html)

## Sources

- 2026-11-12 The Hacker News: Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.