Which versions of MongoDB are affected by CVE-2026-13071?

CVE-2026-13071 affects MongoDB's mongod server, allowing any authenticated user with read-level privileges to crash the database through malicious aggregation pipeline expressions, causing service…. A patch is available.

How to fix or mitigate CVE-2026-13071?

Within 24 hours, audit all database accounts with read privileges and implement principle-of-least-privilege access controls to minimize the number of users who can trigger aggregation operations. Within 7 days, review your aggregation pipeline usage patterns, document which applications require server-side JavaScript functionality, and consider disabling JavaScript execution in aggregation pipelines (via security.javascriptEnabled configuration) if your workloads do not require it. Within 30 days, establish monitoring for anomalous aggregation queries, prepare upgrade testing procedures for MongoDB versions that address this vulnerability, and subscribe to vendor security advisories to deploy patches immediately upon release.

MongoDB CVE-2026-13071

Q: What is the CVSS score of CVE-2026-13071?

CVE-2026-13071 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47790 HIGH

Use After Free (CWE-416)

2026-07-22 cna@mongodb.com

Information Disclosure Use After Free Memory Corruption MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable with a low-privilege read account (PR:L) and no user interaction; impact is a mongod crash so availability-only (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:35 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

AnalysisAI

Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MongoDB's aggregation framework supports operators that execute server-side JavaScript inside the mongod process (historically $where, $function, and $accumulator, backed by an embedded JavaScript engine). The root cause is classed as CWE-416 Use After Free: during document processing, memory tied to the JavaScript execution or intermediate aggregation state is freed and subsequently referenced, corrupting the process and forcing mongod to terminate. Because the JavaScript path runs in the same process as the core database engine, memory mishandling there directly impacts database availability rather than being sandboxed. No CPE strings were provided in the input, so exact affected build ranges cannot be enumerated from this data.

RemediationAI

No vendor-released patch version was identified in the provided data, so the fix version cannot be cited here; monitor MongoDB ticket SERVER-128473 (https://jira.mongodb.org/browse/SERVER-128473) and the official MongoDB security advisories, then upgrade mongod to the fixed release once published. As an immediate compensating control, disable server-side JavaScript execution by starting mongod with security.javascriptEnabled: false (or --noscripting), which blocks the vulnerable $where/$function/$accumulator JavaScript paths entirely - the trade-off is that any legitimate queries or aggregation stages relying on server-side JavaScript will fail, so validate application dependencies first. Additionally, apply least privilege by auditing and revoking read access from untrusted or unnecessary accounts, and restrict network exposure of the mongod port to trusted application hosts, since exploitation requires an authenticated session.