Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-4358 MongoDB Slot-Based Execution Engine Memory Corruption via Authenticated Aggregation Query https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4358
Post summary
The entry announces a new CVE, CVE‑2026‑4358, describing a memory‑corruption flaw in MongoDB triggered by authenticated aggregation queries, without providing any PoC, exploit, or remediation details.
CVE-2026-4358 A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-bas… https://www.cve.org/CVERecord?id=CVE-2026-4358
Post summary
The text announces CVE‑2026‑4358, describing a memory corruption flaw triggered by an authenticated user with write privileges through a crafted $lookup aggregation query.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mongodb | mongodb | - | - | - |