Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that can crash the database server if it is later selected as the primary while still missing some recent changes. MongoDB has released fixed versions. The company said it was not aware of attempts to exploit the vulnerability.