MongoDB patched a 9.5-severity flaw that crashes servers at failover; self-managed users must upgrade
Atlas patches itself during maintenance, while self-managed customers must upgrade every replica-set member by hand across seven branches. That points the cost at MongoDB's legacy license base rather than the cloud growth behind BTIG's $417 Buy, ahead of the December 1 earnings.
Richard Tangfour-minute read
MongoDB+0.49% — MongoDB, up 0.49 percent today this week patched CVE-2026-118383, a flaw it rates 9.5 out of 10 that lets an attacker with no credentials crash a database at the one moment it is built to survive: the failover 1. The fix is shipped and MongoDB says it has seen no attempts to exploit the flaw 1. The work of applying it splits along the product line: Atlas, the managed cloud database, receives fixed versions during scheduled maintenance, while self-managed deployments need the fixed release on every replica-set member by hand 12. That split, rather than the severity score, decides who pays for this.
The crash waits for an election
A replica set is a group of MongoDB servers keeping copies of the same data: one primary takes all writes, and when it goes missing the others elect a replacement 12. Two unauthenticated ping commands carrying a readConcern.afterOpTime value, a field that asks the server to wait until replication reaches a named point, plant pending notifications on a member 1. Planting them breaks nothing: the waiters do not expire, and stay until the member restarts, rolls back or steps down 1.
The crash comes if that member later wins an election while still behind. The catch-up cleanup then runs twice over memory already freed, and the new primary dies before it accepts a single write 12. Authentication does not block the two requests on vulnerable versions 12.
Datadog+0.54% — Datadog, up 0.54 percent today Security Labs, the research arm of the monitoring company Datadog, reproduced the crash and published its findings on November 11 13. MongoDB says the flaw may allow code execution under some conditions; the researchers did not achieve it 1.
Atlas absorbs the fix, the license base absorbs the work
The flaw sat in a batch of 26 vulnerabilities MongoDB fixed this week, a release Italy's national cybersecurity agency summarized on November 11 2. MongoDB's own alert record lists seven affected branches, fixed at 9.0.7 back to 4.4.32, with every earlier release in a branch affected 4.
Atlas applies those fixes itself during scheduled maintenance 1. Self-managed deployments need the fixed release on every member, including members in containers and any that were offline during maintenance 12. That work lands on Enterprise Advanced, MongoDB's paid edition for customers running the database on their own infrastructure 4.
One slice of the base has no upgrade at all: the 8.2 branch has been end of life since July 31 and receives no fixes, while a proof of concept still reproduces the bug on 8.2.12 under a test-only setting 1. For those deployments the only route to a fix is a move to a supported branch 2.
The growth behind BTIG's $417 sits where the flaw does not
BTIG, the brokerage, initiated coverage of MongoDB at Buy this week with a $417 price target, arguing the company can sustain 20%-plus revenue growth for years 5. Its note leans on MongoDB's own three-year targets: total revenue growth above 20%, with Atlas growing in the mid-20s 5. The growth behind the target is therefore the managed cloud, which this flaw touches least 15.
MongoDB raised its full-year guidance in September on Atlas demand and early AI workloads 6. Atlas was 74% of revenue in the year-ago quarter 7.
Revenue growth cleared BTIG's 20% floor in six of the last eight quarters
The flaw lands on growth already re-accelerating, ahead of the December 1 print
Data
| Revenue growth, % YoY | |
|---|---|
| Q3 '24 | 22.3% |
| Q4 '24 | 19.7% |
| Q1 '25 | 21.9% |
| Q2 '25 | 23.7% |
| Q3 '25 | 18.7% |
| Q4 '25 | 26.7% |
| Q1 '26 | 25.2% |
| Q2 '26 | 30.5% |
MongoDB reports its fiscal third quarter on December 1 9. The tell is management's comment on Enterprise Advanced renewals and the Atlas-versus-self-managed mix: the flaw hands self-managed customers upgrade work just before the print. Whether that work moves renewals is not knowable from the record. The BTIG call and the Atlas AI thesis behind it were set up in our November 11 piece on Percona's free MongoDB AI search twin 10.
Deferred revenue swung from shrinking 19% a year to growing 45%
Data
| Deferred revenue, % YoY | |
|---|---|
| Q3 '23 | -19.4% |
| Q4 '23 | -18% |
| Q1 '24 | -17.6% |
| Q2 '24 | -12.5% |
| Q3 '24 | -4.9% |
| Q4 '24 | -4.7% |
| Q1 '25 | -5.9% |
| Q2 '25 | -4.2% |
| Q3 '25 | 20.4% |
| Q4 '25 | 30.8% |
| Q1 '26 | 35.1% |
| Q2 '26 | 44.8% |
The gap is deployment, and the cloud is closing it
A crash-at-failover flaw is a trust test for enterprise infrastructure, and the counterargument is strong: fixes exist on every supported branch, Atlas patches itself, and MongoDB knows of no exploitation 14. On the stock's story that counterargument holds, because the deployment gap sits with the self-managed base while the growth sits with Atlas 15. Anyone running replica sets should still schedule the upgrade now, since the fix is already shipped 1.
The gap between a fix and a protected database is deployment work. On Atlas, MongoDB does that work and the customer sees a maintenance window; on self-managed servers it lands on operations teams this week 12. That asymmetry is what the cloud premium pays for, and on this record it is why the 9.5 matters more to the people planning upgrades than to the share price 12.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
