Which versions of MongoDB Server are affected by CVE-2026-13059?

MongoDB Server vulnerability CVE-2026-13059 (CVSS 8.6) enables authenticated low-privilege users to bypass role-based access controls and read or modify restricted data in default configurations.. A patch is available.

How to fix or mitigate CVE-2026-13059?

Within 24 hours, inventory all MongoDB Server instances and identify which operate without apiStrict mode enabled (the vulnerable default); simultaneously document the roles and privileges of all low-privilege database accounts. Within 7 days, implement enhanced database command logging focused on low-privilege accounts, establish automated alerting for suspicious query patterns (particularly aggregate, find, update, and delete commands with unusual parameters), and create a formal access review process. Within 30 days, enable apiStrict mode across all deployments after testing application compatibility, enforce least-privilege by restricting role definitions, limit MongoDB network access to trusted application and administrative systems only, and conduct forensic audit of database logs from vulnerability disclosure date forward for suspicious activity.

MongoDB Server CVE-2026-13059

Q: What is the CVSS score of CVE-2026-13059?

CVE-2026-13059 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47776 HIGH

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-07-22 cna@mongodb.com

Authentication Bypass MongoDB

8.6

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable command interface with low complexity and no user interaction, but requires authenticated low-privilege access (PR:L); unauthorized reads and writes give C:H/I:H while availability is unaffected (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:31 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 8.6

DescriptionCVE.org

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

AnalysisAI

Authorization bypass in MongoDB Server allows an authenticated low-privileged user to read and write documents that should be shielded by role-based, query-level access controls. Because the server insufficiently validates certain client-supplied command parameters, crafted find, update, delete, and aggregate commands can sidestep the access boundaries enforced for a user's role. The flaw only manifests in non-apiStrict deployments (the default), and per the vendor CVSS 4.0 vector it yields high confidentiality and integrity impact; no public exploit has been identified at time of analysis.

Technical ContextAI

MongoDB implements role-based access control (RBAC) where privileges can be scoped not just to databases and collections but, in some deployments, narrowed further by query predicates so a role only sees or edits a subset of documents. This vulnerability maps to CWE-807 (Reliance on Untrusted Inputs in a Security Decision): the server trusts client-supplied command parameters when making the authorization decision for the find, update, delete, and aggregate command paths. The Stable API 'apiStrict' mode constrains which command shapes and parameters the server will accept; the issue is specific to non-apiStrict configurations, which is the default behavior, meaning the more permissive command parsing path is where the untrusted parameter influences the access-control check. Exact affected build numbers are not enumerated in the provided data (no CPE strings were supplied), so version scoping must be taken from the MongoDB advisory.

RemediationAI

Upgrade MongoDB Server to the fixed release identified in MongoDB SERVER-128433 (https://jira.mongodb.org/browse/SERVER-128433) - no exact patched version number is present in the provided data, so treat the vendor ticket as the authoritative source for the fix version; no vendor-released patch version could be independently confirmed here. As a compensating control until patched, enabling Stable API strict mode (apiStrict:true) on clients/drivers reportedly avoids the vulnerable non-apiStrict command path, at the cost of rejecting non-Stable-API command shapes and possibly breaking applications that rely on them, so test compatibility first. Additionally, tighten RBAC by removing or minimizing low-privilege accounts that depend on query-level document scoping for sensitive collections, rotate credentials for service accounts that could be abused, and monitor find/update/delete/aggregate command auditing for access patterns inconsistent with a user's intended data scope.