Critical Security Update for DBaaS MongoDB (CVE-2026-118383)
Scheduled for Nov 16, 08:00 - 16:00 UTC
Subscribe to Updates
Update
We will be undergoing scheduled maintenance during this time.
Scheduled
Details
IONOS Cloud will roll out a critical security patch across all Managed MongoDB clusters to address CVE-2026-118383 (CVSS 9.5), a vulnerability disclosed by MongoDB on November 10, 2026, that could potentially allow unauthorized access to the MongoDB Server.
This security update is fully managed by IONOS Cloud and will be applied automatically to your clusters. No manual intervention or version upgrades are required on your part.
What does this mean for you?
- Multi-Replica Clusters: Updates are applied via rolling restarts across cluster nodes. Your database will remain online and available throughout the maintenance, though brief connection resets or primary failovers may occur as individual nodes restart.
- Single-Replica Clusters: Because there is no secondary node for failover, single-replica instances will experience a brief interruption (typically lasting a few seconds to a couple of minutes) while the database restarts to apply the patch.
- Connection Endpoints: Your cluster connection strings and DNS endpoints will remain unchanged.
Recommended Actions
While the update is handled automatically, we recommend the following best practices to ensure seamless application continuity:
- Verify Driver Retry Logic: Ensure your application connection strings include standard MongoDB retry parameters (retryWrites=true and retryReads=true) so clients automatically recover from brief node failovers or restarts.
- Plan Around Maintenance Windows (Single-Replica Users): If you operate single-replica clusters, avoid running critical, non-resumable batch jobs during the scheduled window.
Further Information
- Official MongoDB Advisory: Important MongoDB Security Update Available (November 10, 2026)
If you have any questions or require assistance, please contact our Customer Support team at support@cloud.ionos.com.
Affected services: Database as a Service (DBaaS)
Location: Global Services
IONOS Cloud will roll out a critical security patch across all Managed MongoDB clusters to address CVE-2026-118383 (CVSS 9.5), a vulnerability disclosed by MongoDB on November 10, 2026, that could potentially allow unauthorized access to the MongoDB Server.
This security update is fully managed by IONOS Cloud and will be applied automatically to your clusters. No manual intervention or version upgrades are required on your part.
What does this mean for you?
- Multi-Replica Clusters: Updates are applied via rolling restarts across cluster nodes. Your database will remain online and available throughout the maintenance, though brief connection resets or primary failovers may occur as individual nodes restart.
- Single-Replica Clusters: Because there is no secondary node for failover, single-replica instances will experience a brief interruption (typically lasting a few seconds to a couple of minutes) while the database restarts to apply the patch.
- Connection Endpoints: Your cluster connection strings and DNS endpoints will remain unchanged.
Recommended Actions
While the update is handled automatically, we recommend the following best practices to ensure seamless application continuity:
- Verify Driver Retry Logic: Ensure your application connection strings include standard MongoDB retry parameters (retryWrites=true and retryReads=true) so clients automatically recover from brief node failovers or restarts.
- Plan Around Maintenance Windows (Single-Replica Users): If you operate single-replica clusters, avoid running critical, non-resumable batch jobs during the scheduled window.
Further Information
- Official MongoDB Advisory: Important MongoDB Security Update Available (November 10, 2026)
If you have any questions or require assistance, please contact our Customer Support team at support@cloud.ionos.com.
Affected services: Database as a Service (DBaaS)
Location: Global Services
This scheduled maintenance affects: Global Services (Database as a Service (DBaaS)).