MongoDB reports:
MongoDB identified and fixed an important vulnerability
(CVE-2026-118383, CVSS 9.5) that could allow unauthorized access
to the MongoDB Server. We found it internally through our
proactive security program, and we are not aware of any attempts
to take advantage of this vulnerability.
https://jira.mongodb.org/browse/SERVER-138119 reports:
A use-after-free in the replication component of MongoDB Server
can occur when a newly elected replica set primary completes
catch-up. The condition can be caused by requests that do not
require authentication, and may result in the server terminating
unexpectedly or, under certain conditions, arbitrary code
execution in the context of the server process. Replica set
members are affected, including the shard and config server
replica set members of sharded clusters; standalone mongod
instances are not.