Two Anonymous Pings Plant a Time Bomb in MongoDB Failover

MongoDB released a fix for CVE-2026-118383 on November 10, 2026, a use-after-free with a CVSS 4.0 score of 9.5 that triggers during the election of a new primary in a replica set. The discovery, made internally by MongoDB and reproduced by Datadog labs, reveals a two-stage attack: the attacker sends two requests, waits for a topology change, and the crash occurs at a later time.

How the Decoupled Attack Works

The technical mechanism separates action from effect. A client with network connectivity to a replica set member sends two ping commands with the readConcern.afterOpTime parameter. MongoDB, even on versions with authentication enabled, accepts these requests before login: the protocol permits low-level pre-authentication operations, and the ping with that parameter falls within this exposed surface.

The two requests generate listeners in the node's internal queue. According to Datadog Security Labs analysis, these listeners persist until the mongod process restarts, a rollback occurs, or a manual step-down is performed. Until their removal, the node operates normally and logs show no critical anomalies.

The detonation occurs in a subsequent window. When the member that received the pings wins an election as primary, if it is lagging behind another node, it enters a catch-up phase to synchronize. In this phase, the CatchupState::abort_inlock() function handles listener cleanup. Due to the two pings, cleanup executes twice: the second iteration reuses already-freed memory, triggering the use-after-free.

Datadog reproduced the crash on MongoDB Server 8.0.34 in a lab environment. Researchers observed a segmentation fault that left the replica set without a primary. The cluster can elect a new primary and continue operating, so permanent stall is not guaranteed.

Why This Changes the Threat Model

The decoupled nature of CVE-2026-118383 alters traditional detection logic. This is not a vulnerability that manifests at the moment of the initial attack: the two ping requests generate no immediate alarms and leave few indicators. The crash occurs only following a failover event, which the attacker cannot predict or control. This asynchronicity demands detection strategies based on temporal correlation between suspicious pre-auth requests and subsequent anomalous primary election events.

Why Authentication Does Not Block

A distinguishing aspect of this vulnerability is its pre-authentication nature. MongoDB permits discovery and handshaking operations before authentication completes, and the ping with readConcern.afterOpTime exploits this window. Datadog verified that enabling authentication on vulnerable versions does not prevent acceptance of the two requests: the common security control does not apply to this entry vector.

The finding raises structural questions about the pre-auth surface of the MongoDB wire protocol. Replica set databases are often exposed to internal networks deemed trusted. The ability to plant persistent payloads with zero privileges lowers the barrier to entry for an attacker with a network foothold.

"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process."
— CVE-2026-118383 description, CNA/NVD record

What Datadog Verified and What Remains Uncertain

Datadog Security Labs researchers conducted the most detailed independent reproduction available. On vulnerable versions, they confirmed the controlled crash; on patched version 8.0.37, they verified the server rejects both requests as unauthorized and failover completes normally.

Regarding arbitrary code execution, the line between claim and proof is sharp. MongoDB, in the CNA description, states that particular conditions could allow it. Datadog explicitly stated it did not achieve code execution in its lab environment. The proof-of-concept available on GitHub, in reliable mode, requires a setup available only in a test environment; the author maintains the impact is limited to crash and memory corruption.

What to Do Now

Administrators of self-managed deployments must update every replica set member, including shards and config servers in sharded clusters, to the patched versions: 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, or 4.4.32. Containers and offline members require the same attention: a single vulnerable node exposes the entire replica set to crash risk during failover. MongoDB Atlas clusters receive fixes automatically during scheduled maintenance windows.

For deployments that cannot immediately apply the patch, Datadog recommends restricting network access to replica set members. This measure does not eliminate the vulnerability but reduces the attack surface, preventing an attacker from planting the two initial pings. Enabling authentication, while generally recommended, does not block this specific vector on vulnerable versions.

Security teams can monitor logs for three correlated indicators: the unauthenticated ping command with readConcern.afterOpTime ending with MaxTimeMSExpired (log ID 51803); a member entering catch-up phase (ID 21359) followed by two consecutive exits (ID 21363); and fatal signals or backtraces involving CatchupState::abort_inlock(). Temporal correlation between pre-auth requests and anomalous primary election events provides the strongest detection signal.

Context: 26 Vulnerabilities in a Single Update

CVE-2026-118383 is the most severe of 26 vulnerabilities fixed by MongoDB in the same November 2026 update, according to the Italian ACN alert reported by MeteoraWeb. None of the other 25 reaches the same criticality: the combination of pre-authentication access, impact on availability and integrity, and detection complexity makes this use-after-free a case apart.

The 8.2 branch, excluded from the list of affected versions and end-of-life since July 31, 2026, will receive no fixes. Users still running it must plan migration to a supported branch: 8.3, 8.0, or 9.0 depending on compatibility requirements.

Editorial Close

CVE-2026-118383 represents a mutation in the threat model for database vulnerabilities: no complex exploit is needed, no compromised authentication, not even attacker control over the crash timing. Two trivial commands and a wait are enough. The technical barrier is minimal; the temporal barrier — the requirement that a lagging primary win the election — introduces a probabilistic element that must not confuse risk judgment. A replica set without a primary is a stopped service, and in systems handling financial transactions or healthcare data, every second of downtime carries a measurable cost. The patch exists, is tested, and is available for seven version branches. The only remaining variable is the speed with which administrators apply it.

Sources

• thehackernews.com
• rescana.com
• cryptika.com
• mallory.ai
• meteoraweb.com
• news.lavx.hu
• cve.org
• nvd.nist.gov