CVE-2026-13055
HIGH
CVSS 7.1
mongodb_server
Verified Advisory
Authenticated denial of service via $_internalIndexKey in MongoDB (CVE-2026-13055)
An authenticated MongoDB user can crash a mongod server by submitting an aggregation pipeline containing the `$_internalIndexKey` expression with a compound wildcard index specification. The expression fails to handle such specifications, triggering an internal consistency check that aborts the server process. No elevated privileges are required beyond the ability to run an aggregation pipeline.
Affected versions:
- 8.0.27
We recommend updating to: 8.2.11, 8.2.12, 8.0.28, 7.0.39, 8.3.7.
CVSS 7.1 · our assessment: this_week
Reference: https://jira.mongodb.org/browse/SERVER-123081
Details: https://vuln.today/cve/CVE-2026-13055
Verified by vuln.today against published advisories.
Affected versions
- – 8.0.27
Fixed in: 8.2.11; 8.2.12; 8.0.28; 7.0.39; 8.3.7
More advisories for mongodb_server
- CVE-2026-9737 – Query planner crash via $meta sort expression in MongoDB (CVE-2026-9737)
- CVE-2026-13066 – Information disclosure via DBPointer handling in MongoDB server-side JavaScript (CVE-2026-13066)
- CVE-2026-13065 – Denial of service via $linearFill window function in MongoDB (CVE-2026-13065)
- CVE-2026-13064 – CPU exhaustion via exponential $jsonSchema hashing in MongoDB (CVE-2026-13064)
- CVE-2026-13060 – Authorization bypass via duplicate field in MongoDB $graphLookup (CVE-2026-13060)
- CVE-2026-13058 – Denial of service via missing transaction field validation in MongoDB (CVE-2026-13058)