CVE-2026-13055
Received Received - Intake

MongoDB Server Crash via Malicious Aggregation Expression

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13055
EUVD
EUVD-2026-47780

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *-*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows any authenticated user to crash a MongoDB server by using a specific aggregation expression called $_internalIndexKey. The issue occurs when the expression encounters compound wildcard index specifications, causing an internal consistency check to fail and abort the server process. The user must have permission to run aggregation pipelines.

Detection Guidance

Detecting this vulnerability requires checking for MongoDB servers running vulnerable versions. Use commands like 'mongod --version' to check the MongoDB version. If the version is below the patched release, the system may be vulnerable. Monitor server logs for unexpected crashes during aggregation operations.

Impact Analysis

If exploited, this vulnerability can cause a denial of service by crashing the MongoDB server, leading to downtime and potential data unavailability. It requires an attacker to have valid authentication and execute an aggregation pipeline, which may disrupt services relying on the database.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions, leading to violations of availability requirements in GDPR and HIPAA. Downtime may result in unauthorized access risks or failure to meet data protection standards.

Mitigation Strategies

Immediately upgrade MongoDB to the latest patched version. Restrict user access to aggregation pipelines if possible. Ensure no untrusted users have database access. Monitor server stability and apply security patches promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart