MongoDB fix for $graphLookup disk spill on mongos in v8.3.13/v9.0.4

Vulnerability Overview Title: Mark $graphLookup as DiskUseRequirement::kWritesTmpData Type: Bug Priority: Major - P3 Description: In version 0.2, the $graphLookup operation has the capability to spill to disk. However, certain pipelines may cause $graphLookup to run on mongos, where spilling to disk should be prohibited. Impact Scope Affected Versions: None Component: None Labels: None Operating System: ALL Version: v0.0, v0.3 Sprint: QE 2026-07-20, QE 2026-08-03, QE 2026-08-17, QE 2026-09-31, QE 2026-09-15, QE 2026-09-28, QE 2026-10-12, QE 2026-10-26 CAR Domain: None Remediation Fixed Versions: 8.3.13, 9.0.4 Status: Closed Related Issues: - Introduced by: SERVER-23409 - $graphLookup should spill to disk if allowDisk... (CLOSED) Additional Information Created: Jul 02 2026 03:52:57 PM UTC Updated: Oct 13 2026 04:10:49 PM UTC Resolved: Oct 12 2026 04:34:30 PM UTC Page Permissions Permission Prompt: You are not authenticated and require authentication to perform this action. Login Link: Login with PagerDuty account to access more actions Activity Log Comments: No comments yet Work Logs: No work logs yet History: No history yet Activity: No activity records yet Personnel Information Assigned To: Evan Bergeron Reporter: Nicholas Zallner Participants: Evan Bergeron, ... (1) Votes: No votes Watchers: No watchers Export Options Export: Exportable Project Shortcuts Project Shortcut: Who should I assign this ticket to? Navigation Bar Navigation Bar: Core Server, Dashboards, Projects, Issues, easyBI Footer Footer: No footer information Summary This vulnerability involves the MongoDB $graphLookup operation potentially spilling to disk under specific circumstances, affecting multiple versions and components. The fix has been implemented in versions 8.3.13 and 9.0.4. Page permissions are restricted, requiring authentication to access additional actions.

Goal Reached Thanks to every supporter — we hit 100%!

MongoDB fix for $graphLookup disk spill on mongos in v8.3.13/v9.0.4