Executive brief
MongoDB Server's $graphLookup feature is used to retrieve related documents across collections in a single query. An authenticated attacker with aggregation command access could trigger a memory safety defect that crashes the database server or potentially executes unintended code, disrupting service availability.
Technical details
A use-after-free vulnerability exists in MongoDB Server's $graphLookup aggregation stage due to improper initialization order of the unwind iterator and the _visitedDocuments container it iterates over. An authenticated user with permission to issue aggregation and memory-management commands can trigger this flaw by constructing a specially crafted $graphLookup pipeline. The vulnerability allows an internal reference to be used after the underlying memory has been freed, resulting in a server crash or potentially arbitrary code execution. The fix involves ensuring the unwind iterator is destroyed before destroying the _visitedDocuments container. Patches are available in versions 9.0.0-rc0 and 8.3.8.
Affected products
- MongoDB Server before 8.3.8 and before 9.0.0-rc0
Timeline
- 2026-08-11: disclosed
- 2026-06-09: patched: Fix released in versions 8.3.8 and 9.0.0-rc0