CVE-2026-8201: Use-After-Free in MongoDB Server 8.3.2

The impact of CVE-2026-8201 is significant due to the potential for arbitrary code execution. A use-after-free vulnerability allows an attacker to manipulate memory after it has been freed, potentially leading to the execution of malicious code. In this case, an attacker with control over the structure of a client's FLE-related query can trigger this condition. The attacker could then potentially gain control of the MongoDB server and exfiltrate sensitive data or modify database contents. The blast radius is dependent on the privileges of the affected user and the extent of the attacker's control over the query. This vulnerability shares similarities with other use-after-free vulnerabilities where memory corruption leads to code execution.

1. 发布日期2026-05-13

The primary mitigation for CVE-2026-8201 is upgrading to MongoDB Server version 8.3.2 or later. As a temporary workaround, restrict access to FLE functionality to trusted clients only. Implement input validation and sanitization to prevent malicious query structures. Monitor MongoDB logs for unusual activity related to FLE queries. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests, although this may not be effective against authenticated users. After upgrading, verify that FLE functionality is working correctly and that the use-after-free condition is no longer present.