## Summary
CVE-2026-4148 is a use-after-free in MongoDB sharded clusters that can be triggered by an authenticated user with the read role via a specially crafted $lookup or $graphLookup aggregation pipeline. The issue is tied to incorrect cloning/shallow-copying of expression state during pipeline dispatch.
## Technical Details
- Root cause: Expression stores a raw pointer to its ExpressionContext (src/mongo/db/pipeline/expression.h:424), not an intrusive_ptr.
- When $unionWith clones a sub-pipeline, it creates a new ExpressionContext via copyForSubPipeline(...) (src/mongo/db/pipeline/document_source_union_with.cpp:112).
- Some stage copy constructors shallow-copy Expression objects, leaving _expCtx pointing to the original ExpressionContext.
- When the original pipeline is destroyed, the freed ExpressionContext leaves dangling pointers in the cloned expressions, enabling a use-after-free.
- Bug sites called out as unfixed in the referenced material:
- $lookup copy ctor: _letVariables(original._letVariables) (src/mongo/db/pipeline/document_source_lookup.cpp:426)
- $graphLookup copy ctor: _startWith(original._startWith) (src/mongo/db/pipeline/document_source_graph_lookup.cpp:853)
- Trigger conditions described:
- The bug triggers during sharded pipeline dispatch where the clone path is used (src/mongo/db/pipeline/sharded_agg_helpers.cpp:1769).
- A doubly-nested $unionWith is required to reach the problematic clone path.
## Affected
- mongodb versions 7.0.0 through 7.0.31 (exclusive)
## Impact
- Affected users can cause memory safety issues in the aggregation execution path, with the NVD indicating high impact (confidentiality/integrity/availability) under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
## Mitigation
1. Patch/upgrade MongoDB to a version that addresses the ExpressionContext use-after-free described in SERVER-119319.
2. As a compensating control, restrict or monitor aggregation usage that includes $lookup/$graphLookup combined with nested $unionWith, especially in sharded environments.
3. Add detection around suspicious aggregation patterns that include nested $unionWith and $lookup/$graphLookup in a single pipeline.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416