Which versions of MongoDB are affected by CVE-2026-13055?

MongoDB Server is vulnerable to a denial-of-service attack that allows authenticated database users with specific administrative privileges to crash the server, causing application downtime and…. A patch is available.

How to fix or mitigate CVE-2026-13055?

Within 24 hours, audit all MongoDB Server instances in production to identify which users and service accounts hold aggregation-pipeline privileges; immediately revoke these privileges from any account that does not actively require them, and review MongoDB logs for suspicious aggregation pipeline activity. Within 7 days, implement least-privilege access controls by restricting aggregation-pipeline capabilities to only essential application service accounts, deploy network-level segmentation to limit MongoDB access to trusted application servers only, and enable MongoDB audit logging if not currently active. Within 30 days, monitor MongoDB vendor security advisories for patch availability and establish a change management plan for rapid deployment when a fix is released; conduct a full privileged account audit and execute credential resets for all high-permission MongoDB accounts to detect and remediate any compromise.

MongoDB CVE-2026-13055

Q: What is the CVSS score of CVE-2026-13055?

CVE-2026-13055 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47780 HIGH

Reachable Assertion (CWE-617)

2026-07-22 cna@mongodb.com

Denial Of Service MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:31 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

The $_internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

AnalysisAI

Denial of service in MongoDB Server (mongod) lets any authenticated user with aggregation-pipeline privileges crash the database process by invoking the internal $_internalIndexKey aggregation expression against a compound wildcard index. The expression fails to handle compound wildcard index specifications, tripping an internal consistency check (assertion) that aborts the server. No public exploit identified at time of analysis, and the flaw is reported by MongoDB's own CNA as a Denial of Service issue with no confidentiality or integrity impact.