A high-severity use-after-free vulnerability in MongoDB Server allows authenticated attackers to potentially achieve arbitrary code execution or cause service crashes.

This is a use-after-free flaw (CWE-416) occurring within the aggregation engine of sharded clusters. It can be triggered by an authenticated user holding read-level privileges who executes a specially crafted $lookup or $graphLookup aggregation pipeline.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for severe impact on confidentiality, integrity, and availability. Successful exploitation may allow an attacker to crash the database instance or execute arbitrary code with the privileges of the database service, leading to full data compromise or unauthorized access to sensitive information stored within the cluster.

Immediate Action: Upgrade to MongoDB Server versions 8.2.6, 8.0.20, 7.0.31, or later, as these releases contain the necessary security patches.

Proactive Monitoring: Monitor database logs for suspicious or malformed aggregation queries, particularly those utilizing the $lookup or $graphLookup operators from non-administrative users.

Compensating Controls: Restrict the ability to execute aggregation pipelines to trusted service accounts and enforce the principle of least privilege for all database users to limit the potential reach of an attacker.

Public Exploit Available: No

Given the severity of this memory management flaw and the potential for full system compromise, administrators should prioritize patching affected MongoDB clusters during the next maintenance window. Ensure that all database instances are running the updated versions to eliminate the vulnerability surface within the aggregation engine.