Which versions of MongoDB Server are affected by CVE-2026-18706?

MongoDB Server versions 8.3.0 through 8.3.7 contain a use-after-free vulnerability in the aggregation engine that allows privileged database users to crash production databases or potentially execute…. A patch is available.

How to fix or mitigate CVE-2026-18706?

Within 24 hours, inventory all MongoDB Server deployments to identify systems running versions 8.3.0 through 8.3.7, and begin testing MongoDB Server 8.3.8 in development and staging environments to validate compatibility with deployed applications. Within 7 days, deploy MongoDB Server 8.3.8 to all production environments using rolling updates to maintain high availability, prioritizing systems supporting business-critical functions. Within 30 days, confirm all instances have been successfully upgraded to version 8.3.8, audit privilege escalation controls to identify and restrict unnecessary high-privilege database accounts, and document the patching timeline and access control findings.

MongoDB Server CVE-2026-18706

Q: What is the CVSS score of CVE-2026-18706?

CVE-2026-18706 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-56863 HIGH

Use After Free (CWE-416)

2026-08-11 mongodb

GHSA-pv5p-66r3-9fq9

Denial Of Service Use After Free Memory Corruption MongoDB Mongodb Server

7.5

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

PR:H reflects mandatory high-privilege credentials for aggregation and memory-management commands; AC:H captures the precise command-sequencing required to trigger the use-after-free condition.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 20:06 vuln.today

Patch available

Aug 11, 2026 - 19:04 EUVD

CVE Published

Aug 11, 2026 - 18:34 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

AnalysisAI

Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.

Technical ContextAI

MongoDB's $graphLookup is a pipeline aggregation stage designed for recursive graph traversal queries over collections, allowing documents to reference themselves transitively. CWE-416 (Use After Free) describes a class of memory-safety flaw at the C/C++ runtime level where a pointer continues to reference heap memory after that memory has been freed and potentially reallocated, producing undefined behavior including heap corruption, crash-inducing null or wild dereferences, or - under controlled allocation timing - arbitrary code execution via hijacked function pointers or vtable entries. In this case, the flaw arises from an interaction between the $graphLookup stage and memory-management commands: issuing both in a specific sequence creates a window in which the aggregation stage retains an internal reference to a region the memory manager has already released. The affected software is identified by CPE cpe:2.3:a:mongodb:mongodb_server, version range 8.3.0 through 8.3.7, as reported by MongoDB and recorded in EUVD-2026-56863.

RemediationAI

Upgrade MongoDB Server to version 8.3.8 or later, which contains the vendor-released patch for this vulnerability, as referenced at https://jira.mongodb.org/browse/SERVER-128551. If an immediate upgrade cannot be performed, apply MongoDB's role-based access control to restrict the ability to issue $graphLookup aggregation pipelines and memory-management commands (such as serverStatus, freeMonitoring, or related administrative commands) to the minimum set of explicitly trusted accounts. Reducing the number of identities that hold both aggregation and memory-management command privileges shrinks the exploitable surface without disabling MongoDB entirely, though doing so may impact application features that depend on $graphLookup for graph traversal. Network-layer filtering to limit MongoDB port access to known application hosts provides an additional compensating control but does not eliminate risk from already-trusted application accounts.