VYPR
← All advisories
Medium severity6.6NVD Advisory· Published Aug 11, 2026· Updated Sep 16, 2026

CVE-2026-18706

CVE-2026-18706

Description

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • MongoDB/MongoDB3 versions
    cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=8.3.0,<8.3.8
    • cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*
    • cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*
  • osv-coords
    pkg:bitnami/mongodb
    Range: >= 8.3.0, < 8.3.8
  • MongoDB/Serverllm-fuzzy

Patches

Vulnerability mechanics

References

1

News mentions

1