MongoDB identified and fixed an important vulnerability (CVE-2026-118383, CVSS 9.5) that could allow unauthorized access to the MongoDB Server. We found it internally through our proactive security program, and we are not aware of any attempts to take advantage of this vulnerability. This fix to MongoDB’s code is separate from recent industry vulnerabilities and security events.
Action Required
We strongly recommend that all Community Edition users upgrade to a fixed release as soon as possible. The advisory lists the fixed versions, which are available on the MongoDB downloads page.
If you also use MongoDB Atlas, clusters are upgraded automatically to fixed versions during cluster maintenance. If you are currently deferring maintenance, we strongly recommend that you apply the upgrade as soon as possible.
Finding and fixing issues like this is part of MongoDB’s commitment to proactive security hardening and to providing the latest security updates to our users.