CVE-2026-82061

CVE-2026-82061 is a use-after-free (CWE-416) in MongoDB Server's query execution memory tracking subsystem, in which the server can write to already-freed heap memory. An authenticated user holding only read privileges can trigger the flaw by issuing a sequence of standard database commands, and no user interaction is required. The practical outcome is a crash of the server process (denial of service) and potentially memory corruption; the CVSS 4.0 vector indicates no confidentiality impact but high integrity and availability impact. Any deployment that grants database read access to users, applications, or tenants that could be compromised is exposed. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates the 30-day exploitation probability at roughly 0.3%.

What to do: Upgrade MongoDB Server to the patched release identified in MongoDB's official security advisory for CVE-2026-82061 (version ranges are not specified in this data). Until patching, restrict read-capable database accounts to trusted clients, limit network exposure of mongod (avoid direct internet exposure of port 27017, use firewalling/TLS and authentication), and monitor for unexpected mongod crashes or restarts. Because only read privileges are required to trigger the bug, audit which users, service accounts, and applications can connect to affected clusters.