CVE-2026-4148

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Mar 17, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-414816.5LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.CVE-2026-414827.1Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through sCVE-2026-414835.9OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDaCVE-2026-414845.9OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In versions 1.15.0 and earCVE-2026-414857.7Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type asseCVE-2026-414868.8Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tCVE-2026-414875.4Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-CVE-2026-414883.1LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used bCVE-2026-414898.8Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6CVE-2026-41499.8Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute aCVE-2026-414908.3Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 aCVE-2026-414918.1Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14
CVE-2026-4148: High severity, CVSS 8.8 | Vulnix