CVE-2026-120821: Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines
Published Nov 10, 2026
·Updated
A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.
Affected Software
1 affected component
MongoDB MongoDB Server
Event History
Nov 10, 2026
CVE Published
via MITRE·08:17 PM
Data Sourced
via MITRE·08:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:19 PM
DescriptionSeverityWeakness