Skip to main content

Mongodb Server CVE-2026-4148

| EUVDEUVD-2026-12587 HIGH
Use After Free (CWE-416)
2026-03-17 mongodb
Information Disclosure Use After Free Memory Corruption Mongodb Server
8.7
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 17, 2026 - 20:30 euvd
EUVD-2026-12587
Analysis Generated
Mar 17, 2026 - 20:30 vuln.today
CVE Published
Mar 17, 2026 - 15:53 nvd
HIGH 8.7

DescriptionCVE.org

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

AnalysisAI

MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read permissions execute malicious $lookup or $graphLookup aggregation pipeline operations. An attacker can exploit this vulnerability to achieve high-impact outcomes including information disclosure, data manipulation, and denial of service. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as user with read role
Exploit
Construct malicious $lookup aggregation pipeline
Execution
Trigger use-after-free in sharded cluster
Impact
Crash database or leak sensitive data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation MongoDB sharded cluster deployment with authenticated user possessing read role; exploitation requires issuing specially crafted $lookup or $graphLookup aggregation pipeline operators. Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Despite the high CVSS score of 8.8, the real-world risk is moderated by several factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with valid read-only credentials to a MongoDB sharded cluster could craft malicious aggregation queries using $lookup or $graphLookup operations designed to trigger the use-after-free condition. Given the low attack complexity (AC:L) and network accessibility (AV:N), successful exploitation could allow the attacker to execute arbitrary code with database process privileges or cause denial of service through memory corruption. …
Remediation Upgrade MongoDB Server to the patched versions: 8.2.6 or later for the 8.2 branch, 8.0.20 or later for the 8.0 branch, or 7.0.31 or later for the 7.0 branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all MongoDB Server instances running versions 7.0 (before 7.0.31), 8.0 (before 8.0.20), or 8.2 (before 8.2.6) and document their criticality; restrict database user privileges to eliminate unnecessary read access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mongodb Server

View all
CVE-2026-8053 HIGH
8.7 May 12

Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
CVE-2026-9740 HIGH
8.7 Jun 09

Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod

CVE-2026-9742 HIGH
8.2 Jun 09

Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
CVE-2026-8336 HIGH
7.7 May 13

Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
CVE-2026-9753 HIGH
7.2 Jun 09

Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
CVE-2026-9750 HIGH
7.1 Jun 09

MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash t
CVE-2026-9748 HIGH
7.1 Jun 09

Remote denial-of-service in MongoDB Server allows an authenticated user to crash the mongod process by submitting an agg
CVE-2026-9752 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial q
CVE-2026-9743 HIGH
7.1 Jun 09

Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the ser
CVE-2026-9749 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pi
CVE-2026-9747 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting ag
CVE-2026-9746 HIGH
7.1 Jun 09

Denial of service in MongoDB Server occurs when an authenticated user issues a $changeStreams aggregation combined with

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2020-0674 HIGH POC
7.5
CVE-2014-1776 CRITICAL POC
9.8
CVE-2025-24085 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Vendor StatusVendor

Debian

mongodb
Release Status Fixed Version Urgency
(unstable) fixed (unfixed) -

Share

CVE-2026-4148 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy