Which versions of MongoDB Server are affected by CVE-2026-13058?

MongoDB Server (mongod) contains a denial-of-service vulnerability allowing authenticated database users with write privileges to crash the database process through malformed transaction commands,…. A patch is available.

How to fix or mitigate CVE-2026-13058?

Within 24 hours: Inventory all MongoDB instances and audit which user accounts and service principals hold write privileges; immediately revoke write access for all non-essential accounts and restrict to only system service accounts where required. Within 7 days: implement database-level role-based access controls to minimize write access, deploy crash detection and alerting on mongod process health, and validate your MongoDB backup and failover procedures work end-to-end. Within 30 days: continue monitoring vendor security advisories for a patch release; evaluate network segmentation to allow MongoDB connections only from approved application servers, and assess whether application-layer input validation can filter malformed transaction requests.

MongoDB Server CVE-2026-13058

Q: What is the CVSS score of CVE-2026-13058?

CVE-2026-13058 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47777 HIGH

Reachable Assertion (CWE-617)

2026-07-22 cna@mongodb.com

Denial Of Service MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable transaction command with low complexity but requires an authenticated basic-write account (PR:L); impact is availability-only crash, so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:30 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

AnalysisAI

Denial of service in MongoDB Server (mongod) allows an authenticated user holding only basic write privileges to crash the database process by submitting a crafted transaction command that omits some required fields. The inconsistent validation of related transaction parameters trips a fatal internal invariant (CWE-617), aborting mongod and interrupting availability for all clients. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; impact is limited to availability, with no data disclosure or integrity effect.

Technical ContextAI

MongoDB is a widely deployed document-oriented NoSQL database; mongod is its core server daemon that processes queries and multi-document transactions. Multi-document transactions require a coordinated set of command parameters (for example transaction/session and lifecycle fields), and the server relies on internal invariants - runtime assertions that must always hold - to guard correctness. This maps to CWE-617 (Reachable Assertion): rather than gracefully rejecting a malformed command, the code path validates related transaction parameters inconsistently, so an incomplete field set advances past input checks and reaches an invariant that fails, deliberately terminating the process. The root cause is missing/uneven parameter validation on the transaction command surface rather than memory corruption, so the outcome is a controlled fatal abort (DoS) rather than code execution.

RemediationAI

No vendor-released fix version is identified in the provided data, so consult MongoDB SERVER-127661 (https://jira.mongodb.org/browse/SERVER-127661) for the patched maintenance release for your major version and upgrade mongod to it once published; do not deploy an invented version number. As compensating controls until patched, apply least privilege by revoking write roles from accounts that do not need them and auditing which principals hold basic write access, since exploitation requires an authenticated write-capable user. Restrict network reachability of mongod to trusted application hosts using bindIp and firewall rules so that only vetted clients can send commands, and enable authentication and role-based access control if any deployment still runs open. Because a crash affects availability, run mongod within a replica set so an unexpected primary termination triggers automatic failover, and configure process supervision (systemd/automatic restart) to reduce downtime; note these reduce impact but do not prevent a determined authenticated user from repeatedly triggering the abort.