CVE-2026-8201: MongoDB Use-After-Free Vulnerability

CVE-2026-8201 Overview

CVE-2026-8201 is a use-after-free vulnerability [CWE-416] in MongoDB's Field-Level Encryption (FLE) query analysis component. The flaw affects client-side uses of mongocryptd and crypt_shared. An attacker who controls the structure of a client's FLE-related query can trigger memory corruption in the query analysis path.

The vulnerability impacts MongoDB Server's mongocryptd component across multiple release trains. Affected versions include 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. MongoDB tracks the issue as SERVER-122032.

Critical Impact

An attacker controlling FLE query structure can trigger use-after-free conditions, primarily affecting availability of the mongocryptd process with potential for limited confidentiality and integrity impact.

Affected Products

• MongoDB Server mongocryptd v7.0 versions prior to 7.0.34
• MongoDB Server mongocryptd v8.0 versions prior to 8.0.23
• MongoDB Server mongocryptd v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2

Discovery Timeline

• 2026-05-13 - CVE-2026-8201 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8201

Vulnerability Analysis

MongoDB Field-Level Encryption performs client-side encryption of sensitive document fields before data reaches the server. The mongocryptd daemon and the crypt_shared library handle query analysis. They determine which parts of a query reference encrypted fields and require cryptographic rewriting.

The vulnerability resides in this query analysis component. A use-after-free condition occurs when the analyzer references memory that has already been released during processing of a specifically structured FLE query. The flaw is categorized under CWE-416.

Exploitation requires the attacker to control the structure of an FLE-related query submitted through a client driver. The primary observable impact is on the availability of the analyzer process, with secondary potential for limited information disclosure or integrity effects depending on heap state at the time of the dangling reference.

Root Cause

The defect originates in object lifetime management within the FLE query analysis pipeline. A code path releases an internal allocation while another path retains and later dereferences a pointer to that freed region. MongoDB tracks the remediation under issue SERVER-122032.

Attack Vector

The attack vector is network-based but requires low privileges and control over query structure submitted to the client driver. Attack complexity is high, reflecting the need to shape an FLE query that reaches the vulnerable analyzer path. User interaction is not required. The vulnerability affects the mongocryptd or crypt_shared process running alongside the application, not the MongoDB Server mongod process directly. EPSS data places exploitation probability at 0.027%.

No public proof-of-concept code or exploit examples are available. Refer to the MongoDB advisory SERVER-122032 for vendor technical details.

Detection Methods for CVE-2026-8201

Indicators of Compromise

• Unexpected crashes or abnormal termination of the mongocryptd process on application hosts using FLE
• Repeated client driver errors referencing FLE query analysis failures or lost connections to mongocryptd
• Anomalous FLE query patterns originating from application service accounts that deviate from baseline query shape

Detection Strategies

• Monitor process exit codes and core dumps for mongocryptd and applications linking crypt_shared
• Enable verbose logging on client drivers using FLE and alert on parser or analyzer errors
• Correlate application-tier exceptions with mongocryptd restarts to identify potential exploitation attempts

Monitoring Recommendations

• Track installed versions of mongocryptd and crypt_shared across the fleet to confirm patch status
• Audit which application service accounts can submit FLE queries and review query structure logs
• Forward mongocryptd process telemetry and application logs to a centralized analytics platform for correlation across hosts

How to Mitigate CVE-2026-8201

Immediate Actions Required

• Upgrade mongocryptd and associated MongoDB Server components to 7.0.34, 8.0.23, 8.2.9, or 8.3.2 or later
• Update the crypt_shared library deployed with client applications to the matching fixed release
• Restrict which authenticated principals can submit FLE-enabled queries and validate query structure at the application layer

Patch Information

MongoDB has released fixed versions for each affected release train. Apply 7.0.34 for the 7.0 line, 8.0.23 for the 8.0 line, 8.2.9 for the 8.2 line, and 8.3.2 for the 8.3 line. Tracking and additional details are available in the MongoDB JIRA issue SERVER-122032.

Workarounds

• Limit network exposure of mongocryptd to localhost or trusted application hosts only
• Reduce the set of clients permitted to construct FLE queries until patches are deployed
• Implement application-side validation that constrains FLE query shape to expected schemas