--- title: "MongoDB patched a 9.5-severity flaw that crashes servers at failover; self-managed users must upgrade" description: "Atlas patches itself during maintenance, while self-managed customers must upgrade every replica-set member by hand across seven branches. That points the cost at MongoDB's legacy license base rather than the cloud growth behind BTIG's $417 Buy, ahead of the December 1 earnings." publisher: "The Inference" section: "Security" published: 2026-11-12T15:46:29.610Z modified: 2026-11-12T15:46:29.610Z canonical: https://theinference.org/article/mongodb-patched-a-flaw-rated-9-5-out-of-10-that-crashes-servers-at-failover-self-managed-users-must-upgrade language: en keywords: "MongoDB, Security, Databases, Vulnerabilities, Enterprise Software" --- # MongoDB patched a 9.5-severity flaw that crashes servers at failover; self-managed users must upgrade > Atlas patches itself during maintenance, while self-managed customers must upgrade every replica-set member by hand across seven branches. That points the cost at MongoDB's legacy license base rather than the cloud growth behind BTIG's $417 Buy, ahead of the December 1 earnings. [MongoDB](https://theinference.org/markets/companies/mongodb) this week patched CVE-2026-118383, a flaw it rates 9.5 out of 10 that lets an attacker with no credentials crash a database at the one moment it is built to survive: the failover [1]. The fix is shipped and MongoDB says it has seen no attempts to exploit the flaw [1]. The work of applying it splits along the product line: Atlas, the managed cloud database, receives fixed versions during scheduled maintenance, while self-managed deployments need the fixed release on every replica-set member by hand [1][2]. That split, rather than the severity score, decides who pays for this. ## The crash waits for an election A replica set is a group of MongoDB servers keeping copies of the same data: one primary takes all writes, and when it goes missing the others elect a replacement [1][2]. Two unauthenticated ping commands carrying a readConcern.afterOpTime value, a field that asks the server to wait until replication reaches a named point, plant pending notifications on a member [1]. Planting them breaks nothing: the waiters do not expire, and stay until the member restarts, rolls back or steps down [1]. The crash comes if that member later wins an election while still behind. The catch-up cleanup then runs twice over memory already freed, and the new primary dies before it accepts a single write [1][2]. Authentication does not block the two requests on vulnerable versions [1][2]. [Datadog](https://theinference.org/markets/companies/datadog) Security Labs, the research arm of the monitoring company Datadog, [reproduced the crash and published its findings on November 11](https://securitylabs.datadoghq.com/) [1][3]. MongoDB says the flaw may allow code execution under some conditions; the researchers did not achieve it [1]. ## Atlas absorbs the fix, the license base absorbs the work The flaw sat in a batch of 26 vulnerabilities MongoDB fixed this week, [a release Italy's national cybersecurity agency summarized on November 11](https://meteoraweb.com/en/news/mongodb-server-26-vulnerabilities-fixed-and-a-critical-flaw-that-crashes-replica-sets) [2]. [MongoDB's own alert record](https://www.mongodb.com/resources/products/mongodb-security-bulletins) lists seven affected branches, fixed at 9.0.7 back to 4.4.32, with every earlier release in a branch affected [4]. Atlas applies those fixes itself during scheduled maintenance [1]. Self-managed deployments need the fixed release on every member, including members in containers and any that were offline during maintenance [1][2]. That work lands on Enterprise Advanced, MongoDB's paid edition for customers running the database on their own infrastructure [4]. One slice of the base has no upgrade at all: the 8.2 branch has been end of life since July 31 and receives no fixes, while a proof of concept still reproduces the bug on 8.2.12 under a test-only setting [1]. For those deployments the only route to a fix is a move to a supported branch [2]. ## The growth behind BTIG's $417 sits where the flaw does not BTIG, the brokerage, [initiated coverage of MongoDB at Buy](https://www.msn.com/en-us/money/top-stocks/mongodb-receives-buy-rating-as-btig-sees-sustainable-20-plus-revenue-growth/ar-AA2h9tcQ) this week with a $417 price target, arguing the company can sustain 20%-plus revenue growth for years [5]. Its note leans on [MongoDB's own three-year targets](https://theinference.org/article/mongodb-raised-its-growth-targets-on-an-engine-it-does-not-own): total revenue growth above 20%, with Atlas growing in the mid-20s [5]. The growth behind the target is therefore the managed cloud, which this flaw touches least [1][5]. MongoDB raised its full-year guidance in September on Atlas demand and early AI workloads [6]. Atlas was 74% of revenue in the year-ago quarter [7]. *Chart: **Revenue growth cleared BTIG's 20% floor in six of the last eight quarters** Line chart of MongoDB's year-over-year quarterly revenue growth over eight fiscal quarters, from 22.3% in Q3 '24 through 30.5% in Q2 '26, against a 20% reference line marking BTIG's stated sustainable-growth floor.* *Percent change in MongoDB quarterly revenue from the year-ago quarter, from SEC filings. Fiscal quarters as labeled in the filing data, with period end dates there (Q2 '26 ended July 31, 2026). Reference line marks BTIG's stated growth floor. Sources: [5], [8]. [5][8]* MongoDB reports its fiscal third quarter on December 1 [9]. The tell is management's comment on Enterprise Advanced renewals and the Atlas-versus-self-managed mix: the flaw hands self-managed customers upgrade work just before the print. Whether that work moves renewals is not knowable from the record. The BTIG call and the Atlas AI thesis behind it were set up in [our November 11 piece](https://theinference.org/article/percona-shipped-a-free-mongodb-ai-search-twin-btig-s-417-target-on-mongodb-rests-on-atlas) on Percona's free MongoDB AI search twin [10]. *Chart: **Deferred revenue swung from shrinking 19% a year to growing 45%** Line chart of MongoDB's year-over-year growth in deferred revenue, the revenue billed but not yet recognized, across twelve quarters: it shrank by 19.4% in Q3 '23, stayed negative through Q2 '25, then turned positive in the third quarter of fiscal 2025 and reached 44.8% in Q2 '26, the latest filed quarter.* *Year-over-year change in MongoDB's deferred revenue, the billings on its balance sheet that it has not yet recognized as revenue, one fiscal quarter at a time from SEC filings. Fiscal quarters as labeled in the filing data (Q2 '26 ended July 31, 2026). Source: [11]. [11]* ## The gap is deployment, and the cloud is closing it A crash-at-failover flaw is a trust test for enterprise infrastructure, and the counterargument is strong: fixes exist on every supported branch, Atlas patches itself, and MongoDB knows of no exploitation [1][4]. On the stock's story that counterargument holds, because the deployment gap sits with the self-managed base while the growth sits with Atlas [1][5]. Anyone running replica sets should still schedule the upgrade now, since the fix is already shipped [1]. The gap between a fix and a protected database is deployment work. On Atlas, MongoDB does that work and the customer sees a maintenance window; on self-managed servers it lands on operations teams this week [1][2]. That asymmetry is what the cloud premium pays for, and on this record it is why the 9.5 matters more to the people planning upgrades than to the share price [1][2]. ## Takeaway Fixes exist on every supported branch, but only Atlas applies them for you: the deployment work lands on self-managed Enterprise Advanced customers, and on the 8.2 branch there is no fix at all, just before MongoDB talks renewals on December 1. ## Sources 1. [The Hacker News, Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover, 12 November 2026](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html) 2. [Meteora Web, MongoDB, critical CVE-2026-118383 flaw and 26 patches, 12 November 2026](https://meteoraweb.com/en/news/mongodb-server-26-vulnerabilities-fixed-and-a-critical-flaw-that-crashes-replica-sets) 3. [Datadog Security Labs, articles index listing 'CVE-2026-118383: Use-after-free vulnerability in MongoDB', 11 November 2026](https://securitylabs.datadoghq.com/) 4. [MongoDB, MongoDB Alerts: security-related CVEs including CVE-2026-118383, entries dated 10 November 2026, accessed 12 November 2026](https://www.mongodb.com/resources/products/mongodb-security-bulletins) 5. [Seeking Alpha via MSN, MongoDB receives Buy rating as BTIG sees sustainable 20%-plus revenue growth, 10 November 2026](https://www.msn.com/en-us/money/top-stocks/mongodb-receives-buy-rating-as-btig-sees-sustainable-20-plus-revenue-growth/ar-AA2h9tcQ) 6. [Yahoo Finance (Simply Wall St), Why MongoDB (MDB) Is Up 7.2% After Earnings Beat And Raised Atlas-Driven AI Guidance, 2 September 2026](https://finance.yahoo.com/markets/stocks/articles/why-mongodb-mdb-7-2-100846762.html) 7. [24/7 Wall St, MongoDB (MDB) Q2 2026 Earnings: Results, Market Reaction & History, 26 August 2025](https://247wallst.com/companies/mdb/earnings/2026/Q2) 8. [MongoDB, quarterly revenue figures from its SEC filings, retrieved 12 November 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001441816) 9. [Yahoo Finance (Simply Wall St), MongoDB (MDB) Shares Dropped, So What Is Driving Attention Now?, 6 November 2026](https://finance.yahoo.com/markets/stocks/articles/mongodb-mdb-shares-dropped-driving-172007550.html) 10. The Inference, Percona shipped a free MongoDB AI search twin; BTIG's $417 target on MongoDB rests on Atlas, 11 November 2026 (house piece; site unreachable from the research environment, link to be attached by the editor) 11. [MongoDB, quarterly figures from its SEC filings, retrieved 12 November 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001441816) --- MongoDB patched a 9.5-severity flaw that crashes servers at failover; self-managed users must upgrade — The Inference. Canonical: https://theinference.org/article/mongodb-patched-a-flaw-rated-9-5-out-of-10-that-crashes-servers-at-failover-self-managed-users-must-upgrade