Loading vulnerability…
Use-after-free in MongoDB Server aggregation sub-pipelines
CVE-2026-120821 is a use-after-free vulnerability in the aggregation framework of MongoDB Server versions 9.0.0 through versions preceding 9.0.7. Evaluating certain expressions within an aggregation sub-pipeline can trigger the vulnerability. An authenticated user with read privileges can cause unexpected server termination, resulting in denial of service. The specific expressions and affected functions have not been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated user with read privileges can cause MongoDB Server to terminate unexpectedly, disrupting database availability. Code execution, privilege escalation, and confidentiality or integrity impacts have not been established.
Patch, then assume compromise.
Upgrade affected MongoDB Server 9.0 installations to version 9.0.7 or a later fixed release in the same branch.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.