# MongoDB flaw lets unauthenticated requests plant a conditional failover crash

_Published Thursday, November 12, 2026 at 9:54 PM EST · Security, Infrastructure · Latest · Tier 2 — Notable_

A MongoDB Server flaw lets an unauthenticated attacker send two requests that can crash a replica-set member if it later becomes primary while behind on recent changes, The Hacker News reported. Authentication does not block the requests on vulnerable versions.

MongoDB released fixes earlier this week. Self-managed deployments need upgrades on every replica-set member; Atlas clusters receive fixes during maintenance. Datadog researchers reproduced a crash but did not achieve code execution. Attackers cannot themselves make a member fall behind or win an election, and standalone servers are unaffected.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html)

---
Canonical: https://techandbusiness.org/newswire/0AHLDgyG_8ilaOgOWxRxla
Published: 2026-11-13T02:54:17.334Z
Story chronology: 2026-11-12T09:25:00.000Z
Retrieved: 2026-11-13T05:51:37.453Z
Publisher: Tech & Business (techandbusiness.org)