Skip to content
OpenAdvisories
High WID-SEC-2026-0773 3 CVEs

MongoDB: Mehrere Schwachstellen

Published Mar 17, 2026 · Updated Jun 10, 2026 · Revision 2 · de-DE

Vendor: Splunk Product: Enterprise Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um Informationen offenzulegen, und um beliebigen Programmcode auszuführen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 3

  • High 8.8
    CVE-2026-4148

    ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

    A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-4147

    Stack memory disclosure in filemd5 command

    An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.4
    CVE-2026-4358

    Memory safety issues in slot-based execution hash table spill

    A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

    MongoDB MongoDB Server mongodb Ubuntu

Revision history

  1. #2

    Neue Updates von Splunk-SVD aufgenommen

  2. #1

    Initiale Fassung

References