CVE-2026-4148
Published: 17 March 2026
Summary
CVE-2026-4148 is a high-severity Use After Free (CWE-416) vulnerability in Mongodb Mongodb. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4148 is a use-after-free vulnerability (CWE-416) affecting MongoDB sharded clusters. It can be triggered when an authenticated user with the read role issues a specially crafted $lookup or $graphLookup aggregation pipeline. The vulnerability was published on 2026-03-17 and has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker requires network access and an authenticated account with only the read role to exploit this vulnerability remotely with low complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or other severe consequences typical of use-after-free flaws.
Mitigation details are available in the referenced MongoDB advisory at https://jira.mongodb.org/browse/SERVER-119319.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12587
Vulnerability details
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in MongoDB aggregation pipeline allows authenticated read-role user to trigger remote arbitrary code execution on DB server (high C/I/A impact), directly enabling authenticated remote exploitation of a network-accessible service for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in MongoDB sharded clusters by installing vendor-provided patches.
Implements memory safeguards like ASLR and non-executable memory to block exploitation of the use-after-free flaw.
Validates $lookup and $graphLookup aggregation pipeline inputs to block specially crafted payloads triggering the vulnerability.