Cloud service vulnerability, severity high
MongoDB Server pre-auth flaw (CVE-2026-118383) lets attackers crash lagging replica members on failover
Published
A critical flaw in MongoDB Server (CVE-2026-118383) lets an unauthenticated attacker send two requests that set up a crash of the database server. The crash happens only if the server is later elected primary while it still lacks some recent changes. MongoDB released fixed versions earlier this week.
What's affected
- mongodbevery version
What to do
- Upgrade MongoDB Server to the fixed version released by MongoDB
- Check replica set members, since the crash can occur when a lagging member becomes primary
Check whether you were affected
To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it. The check is free and needs no account:
/pharon:check-incident mongodb-server-preauth-failover-crash-2026-11Don't wait for the next one to reach the news. Pharon tells the team that owns the affected repo within minutes. Free for 7 days, no card.
Get alerted for the next oneReferences
Notice mongodb-server-preauth-failover-crash-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.