CVE-2026-4148
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup…
Published Mar 17, 2026 · updated Jun 17, 2026 · mongodb mongodb
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2026 · NIST NVD
Detected
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.
Jun 17, 2026 · NIST NVD
Updated
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.
Affected
- cpe mongodb/mongodbversion unspecified
- cpe mongodb/mongodb8.3.0
Sources
- CVE.orgVulnerability recordCVE-2026-4148
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4148
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.
nvd.nist.gov