Which versions of MongoDB Server are affected by EUVD-2026-47784?

MongoDB Server is vulnerable to denial-of-service attacks and potential data exposure through crafted aggregation queries submitted by authenticated users.. A patch is available.

How to fix or mitigate EUVD-2026-47784?

Immediately audit all MongoDB Server deployments to identify exposure and disable aggregation pipeline functionality where operationally feasible; enable comprehensive query audit logging within 24 hours. Over the next 7 days, implement granular access controls restricting aggregation pipelines to trusted applications only, apply network segmentation to isolate MongoDB systems from untrusted sources, and review recent authentication and query logs for suspicious CodeWScope patterns or repeated anomalies. Monitor MongoDB vendor advisories throughout this period; upon patch release within 30 days, test in non-production and deploy to production within 48 hours of vendor availability.

MongoDB Server EUVD-2026-47784

Q: What is the CVSS score of EUVD-2026-47784?

EUVD-2026-47784 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-13077 HIGH

Out-of-bounds Read (CWE-125)

2026-07-22 cna@mongodb.com

Buffer Overflow Information Disclosure MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Authenticated network user running aggregation pipelines (PR:L, AV:N, AC:L); bounded heap disclosure (C:L), no integrity impact, reliable crash gives A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:37 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

AnalysisAI

Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.

Technical ContextAI

The flaw sits in MongoDB's BSON parsing layer, specifically the accessor functions for the BSON CodeWScope type (a JavaScript code string bundled with a variable scope document). Normally elements arriving over the wire are validated, but BSONColumn - the compressed columnar encoding used for time-series and columnar storage - is decompressed after that validation boundary. An attacker embeds a forged CodeWScope element inside BSONColumn data; when decompressed, its declared size value is used directly in pointer arithmetic without a bounds check. This is a classic CWE-125 (Out-of-bounds Read): the length prefix is attacker-controlled and trusted, so the reader walks past the end of the heap allocation, either faulting (crash) or returning neighbouring heap bytes to the caller. No specific fixed CPE range is provided in the source data, so the exact affected server versions must be confirmed against the MongoDB advisory.

RemediationAI

No vendor-released patch version is identified in the provided data, so the primary action is to consult MongoDB advisory/ticket SERVER-129103 (https://jira.mongodb.org/browse/SERVER-129103) for the fixed release and upgrade mongod to it once published. As compensating controls while a patch is pending: enforce least-privilege authorization so only trusted roles can run aggregation pipelines, and revoke or tighten any application/service accounts that do not require ad-hoc aggregation access (trade-off: may break applications that rely on rich pipeline queries); restrict network exposure of mongod to trusted application tiers only, so the authenticated attack surface is minimized; and monitor for repeated mongod crashes/restarts as an indicator of attempted exploitation. Because the vulnerability is reached through legitimate authenticated query paths, there is no clean feature toggle to disable BSONColumn decompression without affecting time-series/columnar workloads, so credential hygiene and privilege reduction are the most effective interim measures.