CVE-2026-18706

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in MongoDB Server via $graphLookup

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18706

EUVD

EUVD-2026-56863

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is in MongoDB Server's $graphLookup aggregation stage. An authenticated user with access to aggregation and memory-management commands could exploit a use-after-free issue. This occurs when a reference to memory is used after that memory has been freed, potentially causing the server to crash or execute unintended code.

Detection Guidance

This vulnerability involves an issue in MongoDB Server's $graphLookup aggregation stage that could lead to memory corruption. Detection requires checking for server crashes or unusual behavior during aggregation operations. Monitor MongoDB logs for segmentation faults or memory-related errors. Ensure your MongoDB version is updated to the latest patched release.

Impact Analysis

This vulnerability could lead to server crashes, disrupting database operations. In severe cases, it might allow execution of unintended code, which could compromise data integrity or lead to unauthorized access if exploited by a malicious user.

Compliance Impact

This vulnerability could impact compliance by causing data breaches or unauthorized access, violating confidentiality requirements in GDPR and HIPAA. Server crashes may also lead to data unavailability, affecting integrity and availability principles in these regulations.

Mitigation Strategies

Update MongoDB Server to the latest patched version immediately to address the $graphLookup memory management issue. Restrict authenticated user permissions to limit access to aggregation and memory-management commands until patched.

Hi! I’m here to help you understand CVE-2026-18706. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70