# CVE-2026-18704: MongoDB Server privilege escalation in aggregation framework

Source: https://junglewise.ai/threats/cve-2026-18704-mongodb-server-privilege-escalation-in-aggregation-framework  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18704 · Severity: medium · CVSS 6.5 · Published 2026-08-11

MongoDB Server's aggregation pipeline feature contains a flaw that could allow read-only database users to perform unauthorized write operations on collections they should not be able to modify. An attacker with legitimate read-only access could exploit an internal aggregation stage to bypass authorization checks and alter data, creating a data integrity and compliance risk.

Technologies: [MongoDB](https://junglewise.ai/threats/technologies/mongodb), [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-18704 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18704 being exploited in the wild.

**How severe is CVE-2026-18704?** Medium severity, with a CVSS score of 6.5, published 11 August 2026.

**Which products and versions are affected?** MongoDB Server before 8.3.8.

**Is there a fix for CVE-2026-18704?** A patch was published on 2026-08-11: Fix released in MongoDB Server 8.3.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18704 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-18704?** Check whether you run MongoDB or MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in MongoDB Server's aggregation framework, where an internal-use aggregation stage ($idLookup) is reachable by external clients without proper authorization validation of embedded operations. An authenticated user with only read privileges can craft a malicious aggregation pipeline to invoke this stage, bypassing authorization checks and performing write operations against collections they lack write access to. The attack requires valid database authentication but no special network access. MongoDB has patched this issue in version 8.3.8 by tightening validation of $idLookup internal fields and rejecting user-supplied $idLookup operations in pipelines.

## Affected products

- MongoDB MongoDB Server before 8.3.8

## Timeline

- 2026-08-11: disclosed: Published to NVD
- 2026-08-11: patched: Fix released in MongoDB Server 8.3.8

## References

- [https://jira.mongodb.org/browse/SERVER-129936](https://jira.mongodb.org/browse/SERVER-129936)

## Related threats

- [MongoDB replica-set denial of service via unreclaimed wait records](https://junglewise.ai/threats/cve-2026-120828-a-replica-set-database-server-node-does-not-limit-or-reclaim)
- [MongoDB Server authorization bypass in aggregation pipeline](https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of)
- [MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of)
- [MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of)
- [MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource)