CVE-2026-13058

Analyzed Analyzed - Analysis Complete

Authenticated Transaction Command Denial of Service in MongoDB

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13058

EUVD

EUVD-2026-47777

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.12 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user with basic write privileges to crash the mongod process by sending a malformed transaction command missing required fields. The issue occurs due to inconsistent validation between transaction command parameters, causing a fatal internal error and denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for abnormal termination of the mongod process after sending crafted transaction commands. Check MongoDB logs for fatal invariant failures or crashes during transaction operations.

Impact Analysis

The impact includes service disruption as the mongod process terminates abnormally. This can lead to database unavailability, data access issues, and potential data corruption if transactions are interrupted during critical operations.

Compliance Impact

This vulnerability could impact compliance by causing unplanned downtime, potentially violating availability requirements in GDPR and HIPAA. Data integrity risks during crashes may also affect compliance with data protection standards.

Mitigation Strategies

Apply the latest MongoDB security patches immediately. Restrict write privileges to trusted users only. Monitor transaction commands for incomplete field sets and implement input validation for transaction parameters.

Hi! I’m here to help you understand CVE-2026-13058. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70