MongoDB flaw lets unauthenticated requests plant a conditional failover crash

Published Thursday, November 12, 2026 · 9:54 PM EST

A MongoDB Server flaw lets an unauthenticated attacker send two requests that can crash a replica-set member if it later becomes primary while behind on recent changes, The Hacker News reported. Authentication does not block the requests on vulnerable versions. MongoDB released fixes earlier this week. Self-managed deployments need upgrades on every replica-set member; Atlas clusters receive fixes during maintenance. Datadog researchers reproduced a crash but did not achieve code execution. Attackers cannot themselves make a member fall behind or win an election, and standalone servers are unaffected.

Sources

The Hacker News

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security

Researchers report 21 N-central servers compromised through new exploit

Attackers have compromised at least 21 production N-able N-central servers through a newly disclosed exploit chain, security company Huntback told BleepingComputer. Nineteen ran the latest Hotfix 2 release, issued November 10. The attacks installed XMRig cryptocurrency miners.

Security

Apple patches nine HomeView vulnerabilities before first customer deliveries

Apple released HomeView Software Version 27.2 on November 12, fixing nine security vulnerabilities before the first devices reach customers tomorrow. The update includes a fix for a flaw that could let a remote attacker join an iMessage group chat and receive its messages.

Infrastructure Products

AST SpaceMobile outlines rocket plan to address launch shortage

AST SpaceMobile chief executive Abel Avellan outlined plans Thursday to develop the Blacklift rocket to launch the company's Bluebird satellites, Ars Technica reported. He said the telecommunications company has already procured engines for the proposed vehicle.

Security

Researchers find GitHub campaign stole secrets from at least 1,835 targets

Aikido researchers confirmed that a campaign using 4,837 compromised GitHub accounts stole secrets from at least 1,835 targets, BleepingComputer reported.

Policy Infrastructure

Ukraine alleges renewed Starshield drone restrictions; SpaceX denies change

Ukrainian President Volodymyr Zelenskyy said Starshield satellite service again stops working on Ukrainian military drones above 161 kilometers per hour in Russian-occupied Ukrainian territory. SpaceX denied the allegation, telling Ars Technica that there had been no change.

AI Infrastructure

AWS expands AgentCore session capacity and adds idle scaling to zero

AWS has released an updated Amazon Bedrock AgentCore runtime with sessions supporting up to 8 vCPUs and 32 GB of memory, four times the previous capacity. AWS says sessions start in under 2 seconds and support container images up to 10 GB.