MongoDB Server -- Pre-authentication use-after-free in replica set primary catch-up

2026-11-13 · CVE-2026-118383 · VuXML entry

MongoDB reports: MongoDB identified and fixed an important vulnerability (CVE-2026-118383, CVSS 9.5) that could allow unauthorized access to the MongoDB Server. We found it internally through our proactive security program, and we are not aware of any attempts to take advantage of this vulnerability. https://jira.mongodb.org/browse/SERVER-138119 reports: A use-after-free in the replication component of MongoDB …

Affected versions

• mongodb70 < 7.0.48
• mongodb80 < 8.0.37
• mongodb90 < 9.0.7

By system

0 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.