CVE-2026-4148: MongoDB

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

Affected products

• MongoDB MongoDB: from 7.0.0, before 7.0.31 (fixed in 7.0.31); from 8.0.0, before 8.0.20 (fixed in 8.0.20); from 8.2.0, before 8.2.6 (fixed in 8.2.6); version 8.3.0 only

Published 2026-03-17. Last modified 2026-06-17.