Quick answers
- Is CVE-2026-82061 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82061 being exploited in the wild.
- How severe is CVE-2026-82061?
- High severity, with a CVSS score of 8.1, published 8 September 2026.
- Which products and versions are affected?
- MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0.
- Is there a fix for CVE-2026-82061?
- A patch was published on 2026-09-08: Fixed in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, 9.1.0-rc1024 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82061 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-82061?
- Check whether you run MongoDB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free vulnerability exists in MongoDB's OperationMemoryUsageTracker when processing Exchange pipelines containing UnionWith operators with memory-tracking stages like setWindowFields. The vulnerability occurs when a consumer other than consumer-0 wins the race to construct the UnionWith subpipeline first; this creates a memory tracker stored on the client cursor that becomes a dangling pointer after cursor destruction. Subsequent consumers executing the exchange pipeline trigger a use-after-free when accessing the freed memory tracker. The attack requires authentication with read privileges and involves standard database commands; no user interaction is needed beyond query execution. MongoDB has patched this issue in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and 9.1.0-rc1024.
Affected products
- MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, 9.1.0-rc1024