Provenance Record

News article of about 1,078 words (range 400-1200). Clear structure: Overview, affected and fixed versions, preconditions as the sources state them, the 8.2 divergence reported with attribution and not reconciled, exploitation and credit, the sibling CVE and the Herald's own tally. Neutral tone; no AI self-reference.

All nine snapshots read from sources/2026-11/mongodb-fixes-cve-2026-118383-.../ (source-0..8.html.gz), no suspicious_patterns on any source (all null), so no prompt-injection finding. source-0 (The Hacker News, Swati Khandelwal, Nov 12): confirms the quoted 'The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes.' and 'not aware of any attempts to take advantage of this vulnerability.', MongoDB found the flaw itself, 8.2 not among affected versions with 8.2.12 reproducing in a PoC lab test using a test-only setting, 8.2 end of life July 31 per the company's lifecycle schedule, PoC lab test with auth off showing 8.0.37 accepting waiters but running cleanup once, Datadog reproduction in a lab; it does not mention CVE-2026-120828. source-1 (Datadog Security Labs, Nov 11, five named authors): every quote verbatim ('we did not achieve code execution', 'Remote unauthenticated exploitation is possible, but only during a specific window that the attacker does not have visibility into', 'The attacker can't cause the lag or the election', 'rejected immediately with Unauthorized', 'don't tell us how often it would succeed in other topologies', 'might elect a new primary and keep running', 'at the time of its announcement'); four-member lab set, admin access used to pause and stop mongod to create the lag and failover; runs A/B/C as described (A 8.0.34 with requests: exited catch-up twice, SIGSEGV, no primary left; B no requests: stayed up; C 8.0.37: requests rejected, stayed up); lists the same seven fixed releases; does not claim to have discovered the flaw (it says MongoDB found it internally); page describes Datadog's own Cloud Security Management and Cloud SIEM detections, which the article discloses. source-2 (CVE record, cveawg API, JSON): assigner mongodb, published 2026-11-10T20:23:51Z; title 'Pre-authentication use-after-free in MongoDB Server replica set primary catch-up'; description quotes verbatim; seven affected ranges (9.0.0<9.0.7, 8.3.0<8.3.16, 8.0.0<8.0.37, 7.0.0<7.0.48, 6.0.0<6.0.30, 5.0.0<5.0.35, 4.4.0<4.4.32), no 8.2 entry; CNA metrics CVSS 4.0 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), both Critical, both assigned by the CNA (MongoDB), so 'Which It Scored 9.5' is correct; source.discovery INTERNAL; no credits field. source-3 (NVD page) is a JavaScript shell (2.6 KB, 'NVD - Home'), so read by another route: NVD REST API https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118383 fetched 2026-11-13 (sha256 f7a2f3d915d3933860569feb14a5a9a7ce4d8d8a22ac4a3a9a06dcd0a00700ab): vulnStatus Awaiting Analysis, lastModified 2026-11-10T22:08:59.707, exactly two metrics (CVSS 4.0 9.5 and 3.1 9.0), both source [email protected], references SERVER-138119 and SERVER-138175. Same for CVE-2026-120828 (sha256 e1e4ee72c9908ef71bfc78856e9e27cd43decc91565e4b4be82a2f6076dea9e4): Awaiting Analysis, CNA CVSS 4.0 8.7, only reference SERVER-138119. source-4 (GitHub advisory GHSA-fjxh-6vgh-cx2c): 'Unreviewed', Critical, published Nov 10, no credits section; GitHub API /advisories/GHSA-fjxh-6vgh-cx2c returns credits [] and github_reviewed_at null. source-5 (googlesky/CVE-2026-118383 README): 'Affected' row '8.0.x before 8.0.37 (8.0.34 tested); 8.2 builds before the backport (8.2.12 tested)'; SERVER-138175 and SERVER-138119 fixes in 8.0.37 as described; 'when security.authorization is disabled ... even 8.0.37 accepts afterOpTime'; results table mongo:8.2.12 assisted DOUBLE_ABORT_UAF; note '8.2.12 was the newest 8.2 image published at test time and still reproduced the double abort'; 'A remote attacker cannot enable it' for the test-only failpoint; GitHub API repo created_at 2026-11-11T05:59:43Z, single commit by googlesky, no credit claim of discovery. source-6 (CVE-2026-120828 record): published 2026-11-10T20:23:01Z, same seven branches and fixed releases, only reference SERVER-138119, CNA CVSS 4.0 8.7, CWE-770, description quoted verbatim ('which may make the server run out of memory and become unavailable'), discovery INTERNAL. source-7 (NVD page for 120828) is the same JavaScript shell; read via the NVD API as above. source-8 (CISA KEV page snapshot, first 20 of 1,779 rows only): cannot by itself prove absence, so read the KEV JSON feed https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json on 2026-11-13 (sha256 41c8091ad62d508d6f8906ad5cd26b20efe551f7d51b95ecc8a6981fa640b4ea): catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29Z, count 1779; neither CVE-2026-118383 nor CVE-2026-120828 is listed. The article's version and release time come from this feed, which the cited catalog page does not display (recorded as a recommendation). Absence claim 'None of the cited sources reports exploitation in the wild' holds across all nine sources; 'None of the cited sources names an outside reporter' holds (Datadog and the PoC author do not claim discovery). Herald's own NVD count: re-ran NVD API pubStartDate=2026-11-09T00:00 to pubEndDate=2026-11-12T23:59:59.999 (3,631 records, sha256 1b61c9c5... and e0870e7e...), filtered to sourceIdentifier [email protected]: 30 records, not 26. 26 of them are MongoDB Server records, all published 2026-11-10 (confirmed against 26 cveawg records, CVE-2026-118383 and CVE-2026-120803 to 120826 and 120828); the other 4 (CVE-2026-126823, 126835, 126837, 126838) are Atlas SQL JDBC, Node.js and Rust driver records published 2026-11-12. Within the 26, 118383 has the highest CVSS 4.0 score (9.5; next 9.1) and only 118383 and 120828 list the 6.0, 5.0 and 4.4 branches, so both derived statements hold for the 26 and also for the 30. Allowlist: thehackernews.com, securitylabs.datadoghq.com, cveawg.mitre.org, nvd.nist.gov, github.com, cisa.gov all present; no additions needed. www.mongodb.com forum announcement not allowlisted and not cited; nothing in it is needed to support any claim. Anthropic disclosure: not required - the story is MongoDB, Datadog and a CVE; no Anthropic or Anthropic-operated product (Claude Code, Bun) is a subject, in the headline, summary or lead, or in a credit line. The only Claude mention found in the snapshots is a related-links sidebar headline on the Hacker News page, not part of the article.

Headline: 'MongoDB Fixes CVE-2026-118383' is backed by the CVE record (seven fixed branches) and Datadog; 'Which It Scored 9.5' is MongoDB's own CNA CVSS 4.0 score (the 3.1 score of 9.0 is also given in the body); 'Datadog Crashed a Lab Replica Set Primary With Unauthenticated Requests and a Forced Failover' matches Datadog's run A (lab, 8.0.34, two unauthenticated pings, failover created by Datadog with admin access), and 'did not achieve code execution' is kept in the summary and in the second paragraph of the lead. Preconditions (later wins an election while behind, attacker cannot cause lag or election) are stated in the body from Datadog and The Hacker News. Dates and times (CVE 2026-11-10 20:23 UTC; Datadog and PoC repo 2026-11-11, repo 05:59 UTC; Hacker News 2026-11-12) are correct and in order; NVD status and last-modified time still match as of this review. 8.2 divergence: CVE record lists no 8.2; README reports 8.2.12 reproduction; The Hacker News reports both and the July 31 end of life; the article reports each with attribution and does not reconcile them, which is the policy-correct treatment. Sibling CVE-2026-120828 shares SERVER-138119 and the same seven branches and fixed releases, verified. Only error found: the Herald's NVD count (see concerns).

Accurate, well-sourced News coverage with the 8.2 disagreement and the absence-of-exploitation and credit claims handled carefully. APPROVE_WITH_CORRECTIONS for the single imprecise Herald-derived count. Featured candidacy: 2 - critical-rated (CNA CVSS 4.0 9.5) pre-authentication flaw in a database used far beyond security circles, with independent lab reproduction and an unresolved end-of-life 8.2 question, though crash requires a coincident election and no exploitation is reported