Datadog researchers reproduced CVE-2026-118383, a critical MongoDB flaw where two unauthenticated requests can plant waiters that crash a lagging replica-set member after it wins an election and catches up. MongoDB released fixed versions and says Atlas clusters update automatically; researchers reported no code execution in their lab, though MongoDB warns it may occur under some conditions.