CVE-2026-96297: 
MongoDB 脆弱性分析と緩和策

CVE-2026-96297 is a use-after-free (UAF) vulnerability in the aggregation feature of MongoDB Server that allows an authenticated attacker with read privileges to cause the server to return unrelated in-process memory contents to the client, or to crash the server process. The vulnerability was published on October 13, 2026. Affected versions include MongoDB Server 7.0.x before 7.0.45, 8.0.x before 8.0.34, 8.3.x before 8.3.13, and 9.0.x before 9.0.2. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-416 (Use After Free): MongoDB's aggregation pipeline incorrectly reuses or references a memory region after it has been freed. The specific trigger condition is combining an internal aggregation stage with a batch size of 0 in an aggregate command — when these two settings are used together, the server may read from a memory region that has already been released and potentially reallocated for other data. Because the freed memory can be repurposed before it is read, the server may return arbitrary in-process memory to the query client. No public proof-of-concept exploit code has been identified at this time. The vulnerability is tracked upstream in MongoDB's issue tracker as SERVER-132946 (GitHub Advisory).

Successful exploitation primarily impacts confidentiality: query results returned to the client may contain arbitrary data from the MongoDB server process's memory space, potentially exposing sensitive information such as credentials, other users' data, or internal server state. There is no integrity impact, but availability may be affected if the server process terminates unexpectedly due to the memory corruption condition. Exploitation requires an authenticated session with at least read privileges, limiting the attack surface to users who already have database access (GitHub Advisory, Feedly).

As of the disclosure date (October 13, 2026), there is no evidence of in-the-wild exploitation, no public proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting a currently low probability of exploitation. Exploitation is not fully automatable (per NVD SSVC assessment) and requires authenticated access with read privileges, which reduces the overall risk (GitHub Advisory, Feedly).

1. Obtain authenticated access: Acquire credentials for a MongoDB user account with at least read privileges on the target database instance.
2. Identify a vulnerable version: Confirm the target MongoDB Server version falls within the affected ranges (7.0.x < 7.0.45, 8.0.x < 8.0.34, 8.3.x < 8.3.13, or 9.0.x < 9.0.2).
3. Craft the aggregate command: Construct an aggregate command that uses an internal aggregation stage known to trigger the use-after-free condition, combined with a batchSize of 0 in the cursor options (e.g., db.collection.aggregate([<internal_stage>], { cursor: { batchSize: 0 } })).
4. Send the command: Execute the crafted aggregate command against the target MongoDB instance.
5. Observe results: Inspect the returned query results for data that does not belong to the queried collection — this may include fragments of other in-process memory. Alternatively, observe whether the server process crashes, indicating the memory corruption was triggered (GitHub Advisory).

• Logs: MongoDB server logs (mongod.log) showing unexpected process termination (segmentation fault or similar) following aggregate commands with batchSize: 0; repeated aggregate commands from a single authenticated user targeting unusual stage combinations.
• Network: Aggregate command traffic (MongoDB wire protocol, default port 27017) with cursor batchSize set to 0 from unexpected or low-privilege client sources.
• Process: Unexpected mongod process crashes or restarts; core dump files generated by the MongoDB server process following aggregation operations.

MongoDB has released patched versions addressing this vulnerability: upgrade to MongoDB Server 7.0.45 or later (for 7.0.x users), 8.0.34 or later (for 8.0.x users), 8.3.13 or later (for 8.3.x users), or 9.0.2 or later (for 9.0.x users). No configuration-based workaround has been publicly documented; upgrading to a fixed version is the recommended remediation. Organizations should also review and restrict database user privileges to the minimum necessary to reduce the risk of exploitation by low-privilege accounts (GitHub Advisory, Feedly).