CVE-2026-18706: Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18706?
The severity of CVE-2026-18706 is medium with a score of 6.6.
How do I fix CVE-2026-18706?
To fix CVE-2026-18706, update to the latest version of MongoDB Server where the vulnerability has been addressed.
What kind of impact does CVE-2026-18706 have on MongoDB?
CVE-2026-18706 may lead to a denial of service or potentially remote code execution due to a use-after-free vulnerability.
Who is affected by CVE-2026-18706?
CVE-2026-18706 affects authenticated users of MongoDB Server who can issue aggregation and memory-management commands.
What is the nature of the vulnerability in CVE-2026-18706?
CVE-2026-18706 is classified as a Use-After-Free vulnerability in the $graphLookup aggregation stage of MongoDB.