CVE-2026-13058
HIGH
CVSS 7.1
mongodb_server
Verified Advisory
Denial of service via missing transaction field validation in MongoDB (CVE-2026-13058)
An authenticated user with basic write privileges can send a `startOrContinueTransaction` command without the required `autocommit` field, triggering a fatal internal invariant failure in `initializeOperationSessionInfo` and causing the `mongod` process to terminate abnormally. The inconsistent validation between `startTransaction` and `startOrContinueTransaction` parameters allows this denial of service condition to be reached by any authenticated user.
Affected versions:
- 8.0.27
We recommend updating to: 8.2.11, 8.2.12, 8.0.28, 8.3.7, 9.1.0-rc0, 9.0.0-rc1.
CVSS 7.1 · our assessment: this_week
Reference: https://jira.mongodb.org/browse/SERVER-127661
Details: https://vuln.today/cve/CVE-2026-13058
Verified by vuln.today against published advisories.
Affected versions
- – 8.0.27
Fixed in: 8.2.11; 8.2.12; 8.0.28; 8.3.7; 9.1.0-rc0; 9.0.0-rc1
More advisories for mongodb_server
- CVE-2026-9737 – Query planner crash via $meta sort expression in MongoDB (CVE-2026-9737)
- CVE-2026-13066 – Information disclosure via DBPointer handling in MongoDB server-side JavaScript (CVE-2026-13066)
- CVE-2026-13065 – Denial of service via $linearFill window function in MongoDB (CVE-2026-13065)
- CVE-2026-13064 – CPU exhaustion via exponential $jsonSchema hashing in MongoDB (CVE-2026-13064)
- CVE-2026-13060 – Authorization bypass via duplicate field in MongoDB $graphLookup (CVE-2026-13060)
- CVE-2026-13055 – Authenticated denial of service via $_internalIndexKey in MongoDB (CVE-2026-13055)