CVE-2026-4148

HIGH

ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-4148 has a selected CVSS score of 8.7 (high).

Description

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 17, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB Inc / MongoDB Server

Default status: unaffected

CVE List8.2 to < 8.2.6affected
8.0 to < 8.0.20affected
7.0 to < 7.0.31affected

References

2