CVE-2026-4148
No fix known EPSS <1%CVSS 8.8
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.
Products: MongoDB Inc. MongoDB Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 14.04 LTS | mongodb | no fix |
| Ubuntu Pro 16.04 LTS | mongodb | no fix |
| Ubuntu Pro 18.04 LTS | mongodb | no fix |
| Ubuntu Pro 20.04 LTS | mongodb | no fix |