CVE-2026-13071
published 2026-07-22CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
35.3th percentile
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 7.0.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb | >= 8.0.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb | >= 8.3.0 < 8.3.7 | 8.3.7 |
| mongodb | mongodb_server | >= 7.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb_server | >= 8.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb_server | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6 Aggregation memory corruption
vuldb·2026-07-22·CVSS 6.5
CVE-2026-13071 [MEDIUM] MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6 Aggregation memory corruption
A vulnerability was found in MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Aggregation. The manipulation results in memory corruption.
This vulnerability is identified as CVE-2026-13071. The attack can be executed remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript.
ghsa_unreviewed·2026-07-22
CVE-2026-13071 [HIGH] CWE-416 An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript.
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-22
Published