Memory Management Vulnerability in MongoDB Server by MongoDB Inc.

CVE-2026-18706

What is CVE-2026-18706?

A vulnerability exists in MongoDB Server that affects the $graphLookup aggregation stage, potentially allowing authenticated users capable of issuing aggregation and memory-management commands to trigger the use of an internal reference after the associated memory has been freed. This flaw could lead to drastic outcomes such as server crashes or inadvertent execution of unintended code, thereby posing significant risks to data integrity and system stability.

References