CVE-2026-13058
Received Received - Intake

Authenticated Transaction Command Denial of Service in MongoDB

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13058
EUVD
EUVD-2026-47777

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated user with basic write privileges to crash the mongod process by sending a malformed transaction command missing required fields. The issue occurs due to inconsistent validation between transaction command parameters, causing a fatal internal error and denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for abnormal termination of the mongod process after sending crafted transaction commands. Check MongoDB logs for fatal invariant failures or crashes during transaction operations.

Impact Analysis

The impact includes service disruption as the mongod process terminates abnormally. This can lead to database unavailability, data access issues, and potential data corruption if transactions are interrupted during critical operations.

Compliance Impact

This vulnerability could impact compliance by causing unplanned downtime, potentially violating availability requirements in GDPR and HIPAA. Data integrity risks during crashes may also affect compliance with data protection standards.

Mitigation Strategies

Apply the latest MongoDB security patches immediately. Restrict write privileges to trusted users only. Monitor transaction commands for incomplete field sets and implement input validation for transaction parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart