CVE-2026-13073

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in MongoDB via Aggregation Command

Publication date: 2026-07-22

Last updated on: 2026-07-23

Assigner: MongoDB, Inc.

Description

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-23

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13073

EUVD

EUVD-2026-47788

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in MongoDB where an authenticated user with read-only access can crash the mongod process by sending a specially crafted aggregation command. The crash occurs due to an internal engine selection inconsistency caused by specific aggregation options.

Detection Guidance

This vulnerability can be detected by monitoring for abnormal termination of the mongod process after executing crafted aggregation commands. Check MongoDB logs for process crashes or unexpected shutdowns. Ensure only authenticated users with appropriate privileges can execute aggregation commands.

Impact Analysis

If exploited, this vulnerability can disrupt all database operations for connected clients until the mongod process is manually restarted. This leads to temporary unavailability of the database service.

Compliance Impact

This vulnerability causes a denial of service by crashing the mongod process, disrupting database availability. For GDPR, this could impact data availability rights under Article 32. For HIPAA, it may affect access to protected health information, potentially violating the Security Rule's integrity and availability requirements.

Mitigation Strategies

Immediately update MongoDB to the latest patched version to address the aggregation command flaw. Restrict read-only user privileges to prevent unauthorized command execution. Monitor mongod process logs for abnormal terminations and implement failover mechanisms for high availability.

Hi! I’m here to help you understand CVE-2026-13073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70