CVE-2026-118383: Use-after-free vulnerability in MongoDB Server (replica set primary catch-up)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5803 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-118383 MongoDB Primary Catch-Up Double Exit and CatchupState::abort_inlock Crash

Detects the second stage of CVE-2026-118383: a replica set member that logs two primary catch-up exits (event ID 21363) in one 5-minute window, or a fatal backtrace containing CatchupState::abort_inlock(), after entering primary catch-up (event ID 21359). A single catch-up exit is normal; two within one transition followed by a fatal signal is the use-after-free crash sequence, an application-exploitation endpoint denial of service.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1499.004, T1499, T1190
• Data sources: mongod structured JSON log (mongod.log), splunk index=mongodb sourcetype=mongod, sentinel Syslog table (ProcessName=mongod)
• Severity: high
• Confidence: high

Splunk SPL

index=mongodb sourcetype=mongod earliest=-24h ("\"id\":21359" OR "\"id\":21363" OR "CatchupState::abort_inlock")
| spath path=id output=log_id
| eval catchup_entered=if(log_id=21359,1,0), catchup_exit=if(log_id=21363,1,0), fatal_abort_inlock=if(match(_raw,"CatchupState::abort_inlock"),1,0)
| bin _time span=5m
| stats sum(catchup_entered) AS catchup_entries sum(catchup_exit) AS catchup_exits sum(fatal_abort_inlock) AS fatal_events BY host _time
| where catchup_exits>=2 OR fatal_events>0
| convert ctime(_time)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "mongod" and SyslogMessage has_any ("21359", "21363", "CatchupState::abort_inlock")
| extend Payload = parse_json(extract(@"(\{.*\})", 1, SyslogMessage))
| extend LogId = tostring(Payload.id)
| where LogId in ("21359", "21363") or SyslogMessage has "CatchupState::abort_inlock"
| summarize CatchupEntries = countif(LogId == "21359"), CatchupExits = countif(LogId == "21363"), FatalEvents = countif(SyslogMessage has "CatchupState::abort_inlock") by Computer, bin(TimeGenerated, 5m)
| where CatchupExits >= 2 or FatalEvents > 0
| project TimeGenerated, Computer, CatchupEntries, CatchupExits, FatalEvents

Sigma

title: CVE-2026-118383 MongoDB Fatal Backtrace In CatchupState::abort_inlock After Catch-Up
id: 6e2a94d7-1b35-4c80-a7f3-92d1e8c5b602
status: experimental
description: Detects a mongod fatal signal backtrace referencing CatchupState::abort_inlock(), the crash location for the CVE-2026-118383 use-after-free during primary catch-up.
references:
    - https://securitylabs.datadoghq.com/articles/cve-2026-118383-mongodb-server-use-after-free/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-118383
    - https://github.com/advisories/GHSA-fjxh-6vgh-cx2c
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.impact
    - attack.t1499
    - attack.t1499.004
    - attack.initial-access
    - attack.t1190
    - cve.2026.118383
logsource:
    product: mongodb
    service: mongod
detection:
    keywords:
        - 'CatchupState::abort_inlock'
    condition: keywords
falsepositives:
    - None expected; the symbol only appears in catch-up crash or assertion backtraces
level: high

Known false positives:

• Two catch-up exits in one 5-minute bin during two genuine back-to-back elections in an unstable cluster
• Crashes in CatchupState::abort_inlock caused by unrelated bugs on already-patched versions

Tuning notes: Correlate hits with a prior ping/afterOpTime planting alert (SPL-001) and the running version. Tighten span to 1m if elections are frequent. Ensure mongod.log is forwarded after a process crash (flush on restart) so fatal backtraces are not lost.

• 🔒 CVE-2026-118383 MongoDB Unauthenticated afterOpTime Ping From Non-Internal Source · unlock with TL Creds
• 🔒 CVE-2026-118383 MongoDB abort_inlock Crash Followed By mongod Restart · unlock with TL Creds
• 🔒 CVE-2026-118383 MongoDB Planting Request Followed By Primary Catch-Up on Same Member · unlock with TL Creds
• 🔒 CVE-2026-118383 MongoDB Slow ping afterOpTime MaxTimeMSExpired Event · unlock with TL Creds
• 🔒 CVE-2026-118383 Post-Exploitation Hunt: mongod Spawning Shell or Download Utility · unlock with TL Creds
• 🔒 CVE-2026-118383 MongoDB Server Started On Vulnerable Build (Exposure) · unlock with TL Creds
• 🔒 CVE-2026-118383 MongoDB Unauthenticated ping with readConcern.afterOpTime (Waiter Planting) · unlock with TL Creds
• 🔒 CVE-2026-118383 MongoDB Replica Set Member Sweep With afterOpTime Ping Requests · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5803.

Sample indicators (1 of 12)

• URL: hxxps://github[.]com/googlesky/CVE-2026-118383

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

Technical analysis

Datadog reproduced a segmentation fault on 8.0.34 but did not demonstrate code execution; MongoDB was not aware of exploitation when it announced fixes on November 10, 2026.

CVE-2026-118383 (GHSA-fjxh-6vgh-cx2c, CWE-416) is a use-after-free in MongoDB Server's primary catch-up logic. MongoDB found the issue internally through its proactive security program and published fixes on November 10, 2026. The CVSS v4.0 base score is 9.5 (Critical), vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The vendor describes the impact as potentially unauthorized access to the MongoDB Server. Datadog Security Labs published its analysis on November 11, 2026.

Exploit mechanics (per Datadog): in a first stage, an attacker sends two unauthenticated ping requests carrying a readConcern.afterOpTime value to a reachable, vulnerable replica set member. The ping command is accepted before authentication, so enabling authentication does not prevent it. The requests plant stale 'waiters' (pending notifications created for requests that wait for a replication point). These persist until the member restarts, rolls back, or steps down from primary. In a second stage, when that member wins an election while lagging behind another member, the end-of-catch-up cleanup runs twice, uses memory that has already been freed, and crashes the process before the member accepts writes. The backtrace points to CatchupState::abort_inlock(). The attacker cannot cause the lag or the election, which is why the CVSS attack complexity is High. In Datadog's lab the crash took about 40 seconds, but the authors induced the lag and failover themselves, so this is not a real-world estimate.

Impact: a reproduced segmentation fault (denial of service, and a repeated crash on the newly elected primary can disrupt failover and availability of the replica set or shard). Code execution in the server process is described as possible under certain conditions but was not demonstrated. No public PoC was identified, no exploitation was known to MongoDB as of the November 10 announcement, and there is no attribution to any actor. Standalone mongod instances are not affected. Datadog confirmed 8.0.34 vulnerable and found that 8.0.37 rejected the unauthenticated requests.

Detection (log-based, from Datadog): COMMAND 'Slow query' event ID 51803 showing a ping with an unusual readConcern.afterOpTime and a MaxTimeMSExpired errName; primary catch-up entry ID 21359, followed by two catch-up exits ID 21363 within one transition; then a fatal signal or backtrace in CatchupState::abort_inlock(). Log settings may omit the command object, and attr.remote may show a loopback address, so logs from before the failover should be reviewed. There are no network or file IOCs.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499 Endpoint Denial of Service; T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1588.005 Obtain Capabilities; T1588.006 Obtain Capabilities

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation

Patches

• MongoDB 9.0.7
• MongoDB 8.3.16
• MongoDB 8.0.37
• MongoDB 7.0.48
• MongoDB 6.0.30
• MongoDB 5.0.35
• MongoDB 4.4.32
• Atlas clusters are upgraded automatically during maintenance; clusters deferring maintenance should apply it now

Immediate actions

• Upgrade every affected replica set member (including shard and config server replica set members) to the fixed release for its branch
• Verify the running version on all members, including containerized members and any that were offline during maintenance
• Restrict network access to MongoDB ports to only the systems that need them (does not fix the bug; enabling authentication does not block the pre-auth ping)
• Review mongod logs for event IDs 51803, 21359 and 21363 and for fatal signals in CatchupState::abort_inlock(), including logs from before any failover

Workarounds

• Limit inbound access to replica set members via firewall or security groups until patched

Longer-term hardening

• Alert on unauthenticated ping commands with readConcern.afterOpTime and MaxTimeMSExpired slow-query entries
• Keep MongoDB off the public internet and segment database networks
• Retain command objects in slow-query logging so the planting requests can be reviewed

Affected and fixed versions

• MongoDB — MongoDB Server (replica set members, including shard and config server replica sets; standalone mongod not affected)
  Vulnerable versions: Releases of the 4.4, 5.0, 6.0, 7.0, 8.0, 8.3 and 9.0 branches earlier than the fixed versions (8.0.34 confirmed vulnerable by Datadog)
  Fixed in: 9.0.7; 8.3.16; 8.0.37; 7.0.48; 6.0.30; 5.0.35; 4.4.32

Timeline

Last updated 2026-11-12 · revalidated 1× · latest source

• 2026-07-31 MongoDB 8.2 branch reaches end of life (per The Hacker News); it receives no security fix, and the public PoC later reproduces the double abort on 8.2.12.
• 2026-11-10 MongoDB discloses the flaw was found internally through its proactive security program and that it is not aware of any attempts to exploit it.
• 2026-11-10 MongoDB states Atlas clusters are upgraded automatically to fixed versions during cluster maintenance, urges Community Edition users to upgrade as soon as possible, and says the fix is separate from recent industry vulnerabilities.
• 2026-11-10 Fixed releases are available: 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32. Atlas clusters are upgraded automatically during maintenance.
• 2026-11-10 CVE-2026-118383 is published in NVD and the GitHub Advisory Database (GHSA-fjxh-6vgh-cx2c, CWE-416), referencing SERVER-138119 and SERVER-138175.
• 2026-11-10 MongoDB announces an important security update for CVE-2026-118383 (CVSS 9.5), found internally and with no known exploitation attempts.
• 2026-11-11 Datadog documents log indicators: event ID 51803 (slow query ping), IDs 21359 and 21363 (catch-up entry and double exit), and a fatal signal in CatchupState::abort_inlock(). Datadog notes that 8.0.37 rejected the unauthenticated requests.
• 2026-11-11 Datadog lab runs on 8.0.34: two unauthenticated ping requests followed by a lagging-member election caused two catch-up exits and a SIGSEGV; a control run without requests stayed up; on 8.0.37 both requests were rejected with Unauthorized.
• 2026-11-11 Datadog Security Labs publishes its analysis, reproducing a segmentation fault on MongoDB 8.0.34 through two unauthenticated ping requests with readConcern.afterOpTime. Code execution was not demonstrated.
• 2026-11-12 The Hacker News reports the flaw and its log indicators (IDs 51803, 21359, 21363, CatchupState::abort_inlock() crash).
• 2026-11-12 Public PoC repository googlesky/CVE-2026-118383 is referenced in coverage; the reliable 'assisted' mode requires test-only settings a remote attacker cannot enable, and no exploitation in the wild is reported.

Update history

• 2026-11-12 — Critical Pre-Auth MongoDB Use-After-Free (CVE-2026-118383) Can Crash Lagging Replica Set Members on Failover: What changed Exploitability THEORETICAL → POC_PUBLIC because a public PoC (googlesky/CVE-2026-118383) now exists. Severity, CVSS 9.5 and status are unchanged. The report's MONITORING status is not applied because it is not an escalation.

Sources cited

• GitHub Advisory GHSA-fjxh-6vgh-cx2c GitHub · Advisory · 2026-11-10
• NVD: CVE-2026-118383 NVD (NIST) · Advisory · 2026-11-10
• CVE-2026-118383: Use-after-free vulnerability in MongoDB (Datadog Security Labs) securitylabs.datadoghq.com · Research · 2026-11-11
• Important MongoDB Security Update Available - Action Required (November 10, 2026) mongodb.com · Vendor report · 2026-11-10
• MongoDB JIRA SERVER-138119 jira.mongodb.org · Vendor report · 2026-11-10
• MongoDB JIRA SERVER-138175 jira.mongodb.org · Vendor report · 2026-11-10
• MongoDB Log Messages reference (v8.0) mongodb.com · Vendor report · 2026-11-11

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Previous and next in vulnerability

• Fortinet2Shell: FortiClient Local API Origin Validation Flaw Enables Code Execution via Malicious Websites (CVE-2026-121529) Previous report
• Multiple Windows Remote Desktop Client Vulnerabilities Allow Code Execution (CVE-2026-119934, CVE-2026-119858, CVE-2026-119390, CVE-2026-95964) Next report