Which versions of MongoDB Server are affected by CVE-2026-13066?

MongoDB deployments with server-side JavaScript enabled face an information disclosure vulnerability that could expose internal server process memory to authenticated database users.. A patch is available.

How to fix or mitigate CVE-2026-13066?

Within 24 hours, audit your MongoDB deployment to identify instances with server-side JavaScript execution enabled by reviewing configuration files and querying admin.system.version; document affected systems and their data sensitivity classification. Within 7 days, disable server-side JavaScript execution at the application layer if not actively required for production operations, restrict database user privileges to the principle of least privilege, and remove database permissions for server-side operators ($where, mapReduce, $function). Within 30 days, monitor MongoDB security advisories for patch availability, work with MongoDB support to confirm your deployment's vulnerability status, and establish a rapid-deployment process to apply the vendor patch once released.

MongoDB Server CVE-2026-13066

Q: What is the CVSS score of CVE-2026-13066?

CVE-2026-13066 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47795 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-22 cna@mongodb.com

Memory Corruption Information Disclosure MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and low-complexity, but requires an authenticated user (PR:L) and server-side JS; impact is confidentiality-only memory disclosure, so I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:33 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

AnalysisAI

Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MongoDB supports server-side JavaScript execution (via features such as $where, mapReduce, and the eval-style engine) to run application logic inside the database process. BSON is MongoDB's binary serialization format, and DBPointer is a legacy/deprecated BSON type (a reference to another collection and ObjectId). The root cause is classified as CWE-843 (Type Confusion): the serializer mishandles DBPointer objects when producing the BSON returned to the client, so bytes that were never intended for the response - internal process memory - are copied into the result buffer. Because the leak originates from the trusted server process address space, disclosed memory could contain sensitive material such as buffers from other operations.

RemediationAI

Apply the MongoDB-released fix once the patched maintenance versions are published; refer to the vendor ticket https://jira.mongodb.org/browse/SERVER-127694 for the exact fixed build numbers, which are not stated in the available data (do not assume a version). As an immediate compensating control, disable server-side JavaScript execution by starting mongod with security.javascriptEnabled set to false (or the --noscripting option), which eliminates the vulnerable code path entirely; the trade-off is that $where queries, mapReduce, and $function/$accumulator aggregation operators will no longer work, so validate that no application relies on them first. Additionally, tighten role-based access control so that only trusted, least-privilege accounts can issue queries, since exploitation requires authenticated access.