CVE-2026-4358: 
MongoDB vulnerability analysis and mitigation

CVE-2026-4358 is a double-free/use-after-free memory corruption vulnerability in MongoDB's slot-based execution (SBE) engine, triggered by a specially crafted aggregation query using $lookup. An authenticated user with write privileges can cause the memory issue when an in-memory hash table is spilled to disk during query execution. Affected MongoDB versions include 7.0.0–7.0.30, 8.0.0–8.0.19, and 8.2.0–8.2.5; IBM Cloud Pak for AIOps is also affected as a downstream consumer. The vulnerability was published on March 17, 2026, with a CVSS v3.1 base score of 7.5 (High) (MongoDB JIRA, IBM Advisory).

The root cause is classified as CWE-415 (Double Free): when the SBE engine processes a $lookup aggregation that forces a hash join and the resulting hash table exceeds 100 MB, causing a spill to disk, a duplicate key insertion with a heap-stored value triggers a double-free or use-after-free condition in memory management. The attack vector is network-based, requiring low privileges (authenticated write access) and high attack complexity — specifically, the SBE engine must select hash join, the hash table must exceed 100 MB, and a duplicate key must be encountered during the spill operation. A concrete, reproducible trigger sequence is documented in the MongoDB JIRA issue: db.local.aggregate({$lookup: {from: 'foreign', localField: 'k', foreignField: 'k', as: 'out'}}) under the defined conditions (MongoDB JIRA).

Successful exploitation can allow an authenticated attacker with write privileges to corrupt heap memory, potentially leading to arbitrary code execution with the privileges of the MongoDB server process. This results in high confidentiality, integrity, and availability impact — an attacker could exfiltrate data, tamper with database contents, or crash the database service. In environments where MongoDB runs with elevated OS privileges, exploitation could facilitate lateral movement within the host system (MongoDB JIRA, IBM Advisory).

A proof-of-concept exploit with a concrete, reproducible trigger sequence is publicly documented in the MongoDB JIRA issue (SERVER-118849), with high confidence assessed by Feedly threat intelligence. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.057%, reflecting low but non-zero probability of near-term exploitation. Nessus detection plugins (IDs 303007 and 303196) are available for scanning (MongoDB JIRA).

1. Reconnaissance: Identify MongoDB instances running versions 7.0.0–7.0.30, 8.0.0–8.0.19, or 8.2.0–8.2.5 using network scanning tools (e.g., Nmap, Shodan) or by querying db.version() with valid credentials.
2. Authenticate: Obtain or use existing credentials for a MongoDB user account with write privileges on a target database.
3. Prepare collections: Create or populate two collections (local and foreign) with sufficient data to ensure the hash join hash table will exceed 100 MB during the $lookup operation, and include duplicate keys to trigger the spill condition.
4. Craft malicious aggregation query: Execute the following query to trigger the SBE hash join with hash table spill: db.local.aggregate({$lookup: {from: 'foreign', localField: 'k', foreignField: 'k', as: 'out'}}) — ensuring SBE selects hash join, the hash table exceeds 100 MB, and a duplicate key is present in heap memory at spill time.
5. Trigger memory corruption: The double-free or use-after-free condition is triggered in the SBE engine during the disk spill, potentially leading to process crash or, under controlled conditions, arbitrary code execution as the MongoDB process user (MongoDB JIRA).

• Logs: MongoDB server logs showing unexpected crashes or segmentation faults (SIGSEGV, SIGABRT) in the mongod process, particularly following aggregation pipeline execution; log entries referencing SBE engine errors or hash table spill operations.
• Process: Unexpected termination or restart of the mongod process; child processes spawned by mongod that are not part of normal operation.
• Network: Authenticated connections from unusual source IPs executing large aggregation queries with $lookup stages against collections with high data volumes.
• File System: Unexpected temporary spill files created in the MongoDB --dbpath or --tempPath directory during aggregation operations, particularly at sizes exceeding 100 MB.

MongoDB has released patched versions addressing this vulnerability: upgrade to 7.0.31 or later, 8.0.20 or later, or 8.2.6 or later. IBM Cloud Pak for AIOps users should refer to the IBM advisory for applicable fix guidance. As a workaround where immediate patching is not possible, restrict write privileges to only trusted and necessary users, and consider network segmentation to limit access to MongoDB instances. Monitoring aggregation query patterns for unusual or large $lookup operations can help detect exploitation attempts (MongoDB JIRA, IBM Advisory).

IBM issued a security advisory acknowledging the impact of CVE-2026-4358 on IBM Cloud Pak for AIOps and directing customers to apply fixes (IBM Advisory). Splunk also published an advisory (SVD-2026-0610) referencing this CVE, indicating broader ecosystem impact beyond MongoDB itself. Tenable released Nessus detection plugins (303007, 303196) shortly after disclosure, enabling rapid scanning for vulnerable instances.