Which versions of MongoDB are affected by CVE-2026-13076?

MongoDB server deployments are vulnerable to a denial-of-service attack (CVE-2026-13076) where authenticated database users with write access can crash the mongod process through specially crafted…. A patch is available.

How to fix or mitigate CVE-2026-13076?

Within 24 hours, audit your MongoDB deployments to identify which user accounts have both aggregation query execution rights and database write access, particularly in production environments. Within 7 days, implement role-based access controls to restrict aggregation query capability to trusted administrative accounts only, and enable database audit logging to track all aggregation pipeline executions. Within 30 days, monitor MongoDB's security advisories for vendor patches and establish a change management process to deploy updates when available; concurrently review all database user accounts to minimize unnecessary privileges.

MongoDB CVE-2026-13076

Q: What is the CVSS score of CVE-2026-13076?

CVE-2026-13076 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47785 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-22 cna@mongodb.com

Denial Of Service MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable authenticated user with write and aggregation rights (PR:L) triggers low-complexity availability-only crash; no confidentiality or integrity impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:36 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

AnalysisAI

Denial of service in MongoDB's aggregation framework allows an authenticated database user with write access to crash the mongod process by triggering a specific data type conversion operation that consumes disproportionate memory, causing the operating system's out-of-memory killer to terminate the process under memory pressure. Affected are MongoDB server deployments where low-privileged users can run aggregation queries; the CVSS 4.0 score is 7.1 with high availability impact and no confidentiality or integrity impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

MongoDB's aggregation framework is a pipeline-based data processing engine within the mongod server that transforms documents through staged operations, including type conversion expressions (e.g. $convert / type-coercion operators). This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): a particular data type conversion operation allocates memory disproportionate to the input without an effective upper bound or throttle, so a single crafted aggregation can grow mongod's resident memory until the OS OOM-killer terminates the process. The root cause is unbounded memory consumption inside the aggregation execution path rather than a memory-safety corruption bug, which is why the impact is availability-only.

RemediationAI

Upgrade to the MongoDB Server release that addresses SERVER-128584 once available; no vendor-released patch version was identified at time of analysis, so consult the MongoDB advisory at https://jira.mongodb.org/browse/SERVER-128584 for the exact fixed build. As compensating controls until patched, apply least-privilege role-based access control so that only trusted roles hold write plus aggregation privileges (revoke unnecessary readWrite/aggregation grants), which reduces the pool of accounts that can trigger the crash but may disrupt legitimate ETL/reporting workloads that rely on aggregations. Additionally, run mongod under an OS cgroup/systemd memory limit and enable automatic process restart (e.g. systemd Restart=on-failure or a replica-set arbiter/failover) so an OOM kill causes rapid recovery rather than sustained outage - noting this mitigates downtime duration, not the crash itself. Where feasible, monitor for anomalous memory spikes and long-running aggregation operations and terminate them via server-side operation limits.