CVE-2026-13068

Analyzed Analyzed - Analysis Complete

Authenticated Cursor Termination Privilege Escalation in MongoDB

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13068

EUVD

EUVD-2026-47793

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.39 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.12 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user with cursor termination privileges on one database to incorrectly terminate active cursors on a separate database. This disrupts ongoing query operations for other users due to an authorization check that fails to scope privileges correctly to the appropriate namespace.

Detection Guidance

This vulnerability involves incorrect privilege scoping for cursor termination across databases. Detection requires reviewing database logs for unauthorized cursor termination attempts and verifying privilege configurations. Check for users with cursor termination rights who are not scoped to specific databases.

Impact Analysis

This vulnerability can cause disruptions in database operations by terminating active cursors used by other users. This may lead to incomplete or failed queries, impacting performance and availability of the database for legitimate users.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to disrupt database operations. For GDPR, this may affect data integrity and availability, which are key principles. For HIPAA, it could interfere with the integrity of electronic protected health information (ePHI) if active queries are terminated.

Mitigation Strategies

Review and restrict cursor termination privileges to ensure they are scoped to the correct database namespace. Apply patches or updates if available from the vendor.

Hi! I’m here to help you understand CVE-2026-13068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70