CVE-2026-18706 — Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Executi…

CVE-2026-18706

Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution PUBLISHED

Description (CNA)

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.3.0 before 8.3.8

CWE

CWE-416

References

https://jira.mongodb.org/browse/SERVER-128551

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.