CVE-2026-18706
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.
Risk Assessment
The risk includes potential server crashes and possible execution of unauthorized code, leading to system integrity and availability issues.
Recommendation
It is recommended to update MongoDB Server to a patched version and restrict privileges for issuing aggregation and memory-management commands.
Original NVD description (English source)
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.