FreeBSD : MongoDB Server -- Pre-authentication use-after-free in replica set primary catch-up (e8416dd1-df3e-11f1-8608-589cfc0f9aca)

critical Nessus Plugin ID 380305

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e8416dd1-df3e-11f1-8608-589cfc0f9aca advisory.

MongoDB reports:
MongoDB identified and fixed an important vulnerability (CVE-2026-118383, CVSS 9.5) that could allow unauthorized access to the MongoDB Server. We found it internally through our proactive security program, and we are not aware of any attempts to take advantage of this vulnerability.
https://jira.mongodb.org/browse/SERVER-138119 reports:
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 380305

File Name: freebsd_pkg_e8416dd1df3e11f18608589cfc0f9aca.nasl

Version: 1.1

Type: Local

Family: FreeBSD Local Security Checks

Published: 11/13/2026

Updated: 11/13/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.8

Percentile: 99.3

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-118383

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.5

Threat Score: 9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:mongodb70, p-cpe:/a:freebsd:freebsd:mongodb80, p-cpe:/a:freebsd:freebsd:mongodb90

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/13/2026

Vulnerability Publication Date: 11/10/2026

Reference Information

CVE: CVE-2026-118383

Detections

Analytics