CVE-2025-13643: MongoDB Server DOS Vulnerability

CVE-2025-13643 Overview

CVE-2025-13643 is a missing authorization vulnerability [CWE-862] in MongoDB Server. A user holding a limited set of privilege actions can terminate queries that other users are executing on the same cluster. This creates a denial of service condition by preventing a fraction of queries from completing successfully.

The flaw affects MongoDB Server 7.0 releases prior to 7.0.26 and MongoDB Server 8.0 releases prior to 8.0.14. Exploitation requires authenticated access with low privileges, and the issue impacts query availability rather than data confidentiality or integrity.

Critical Impact
An authenticated low-privileged user can disrupt workloads by terminating queries belonging to other users, degrading application availability on shared MongoDB clusters.

Affected Products

MongoDB Server 7.0 versions prior to 7.0.26
MongoDB Server 8.0 versions prior to 8.0.14
MongoDB Server 8.2.0 alpha releases (alpha, alpha0, alpha1, alpha2)

Discovery Timeline

2025-11-25 - CVE-2025-13643 published to the National Vulnerability Database
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-13643

Vulnerability Analysis

MongoDB Server exposes administrative operations that allow users to terminate running operations, typically through commands such as killOp or killSessions. These operations are intended to be restricted so that users can only terminate operations they own, with cross-user termination reserved for administrators.

The vulnerability stems from an authorization check that fails to properly validate ownership of a target operation against the privileges held by the invoking user. A user granted a limited set of privilege actions can therefore terminate queries initiated by other users on the same cluster. The impact is confined to availability. Attackers cannot read, modify, or delete data through this flaw, but repeated termination of long-running queries can disrupt analytics jobs, replication helpers, and application traffic.

Root Cause

The root cause is a missing authorization check [CWE-862] in the operation-termination code path. The server grants the ability to invoke the termination command based on a privilege action, but does not consistently verify that the caller is permitted to act on operations owned by other users. This mismatch between coarse command-level permission and fine-grained per-operation ownership enables cross-user termination.

Attack Vector

Exploitation requires network access to the MongoDB cluster and valid credentials with the limited privilege set that exposes the termination action. An attacker enumerates in-flight operations through standard commands and issues termination requests against operation identifiers owned by other users. Attack complexity is high because the attacker must correctly identify active operation IDs belonging to victim users. See the MongoDB Jira Issue SERVER-103582 for vendor-provided technical details.

Detection Methods for CVE-2025-13643

Indicators of Compromise

Repeated invocations of killOp or killSessions originating from non-administrative accounts in MongoDB audit logs.
Unexpected OperationKilled or Interrupted errors returned to application users whose queries did not time out.
A single low-privileged account issuing termination commands against operation IDs it did not create.

Detection Strategies

Enable MongoDB auditing and filter for killOp, killSessions, and killCursors events correlated with the invoking user and the originating user of the targeted operation.
Baseline the normal rate of operation terminations per role and alert on deviations, especially from accounts that should not perform administrative work.
Correlate application-side query failures with server-side termination events to detect targeted disruption of specific workloads.

Monitoring Recommendations

Forward MongoDB audit logs to a centralized analytics platform and retain them for behavioral analysis.
Monitor the MongoDB currentOp and serverStatus outputs for sustained patterns of foreign operation termination.
Alert on new or unusual role assignments that grant operation-management privileges to non-administrative accounts.

How to Mitigate CVE-2025-13643

Immediate Actions Required

Upgrade MongoDB Server 7.0 deployments to version 7.0.26 or later.
Upgrade MongoDB Server 8.0 deployments to version 8.0.14 or later.
Review role definitions and remove operation-management privileges from accounts that do not require them.
Rotate credentials for any low-privileged account suspected of abusing cross-user termination.

Patch Information

MongoDB has resolved the issue in Server releases 7.0.26 and 8.0.14. Pre-release 8.2.0 alpha builds should be replaced with a fixed general-availability release when published. Patch details and tracking are available in the MongoDB Jira Issue SERVER-103582.

Workarounds

Apply the principle of least privilege and audit custom roles that include operation-termination actions.
Isolate tenants onto separate clusters or databases where shared-cluster disruption is unacceptable.
Restrict network access to MongoDB to known application hosts to reduce the pool of accounts that could be abused.

bash

# Example: revoke operation-management privileges from a non-admin role
mongosh --eval '
  db.getSiblingDB("admin").revokePrivilegesFromRole(
    "appReadWriteRole",
    [ { resource: { cluster: true }, actions: [ "killop", "killAnySession" ] } ]
  )
'