CVE-2025-6713 Overview
CVE-2025-6713 is an authorization flaw in MongoDB Server. An authenticated but unauthorized user can craft an aggregation pipeline that abuses the $mergeCursors stage to read data outside their permission scope. The vulnerability stems from improper handling of the $mergeCursors stage during aggregation processing [CWE-285]. Successful exploitation exposes confidential collection data without triggering additional authorization checks. MongoDB has released fixes in versions 8.0.7, 7.0.19, and 6.0.22.
Critical Impact
An authenticated attacker with low privileges can read database contents they are not authorized to access, bypassing MongoDB's role-based access controls through malformed aggregation pipelines.
Affected Products
- MongoDB Server 8.0 versions prior to 8.0.7
- MongoDB Server 7.0 versions prior to 7.0.19
- MongoDB Server 6.0 versions prior to 6.0.22
Discovery Timeline
- 2025-07-07 - CVE-2025-6713 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-6713
Vulnerability Analysis
MongoDB's aggregation framework processes data through a pipeline of stages. The $mergeCursors stage is an internal stage used by mongos to combine result streams from multiple shards during distributed query execution. It expects trusted input from routing components rather than end-user submissions.
The flaw allows an authenticated client to submit an aggregation pipeline that includes $mergeCursors directly. When the server processes this pipeline, it fails to re-validate the authorization context against the cursors being merged. As a result, data from collections outside the user's authorized scope is returned in the query response.
The issue is scoped to confidentiality. The CVSS vector indicates impact on data confidentiality only, with integrity and availability unaffected. The vulnerability requires network access and valid low-privilege credentials, and no user interaction is needed.
Root Cause
The root cause is improper authorization enforcement [CWE-285] within the $mergeCursors aggregation stage. MongoDB Server treats cursors passed to this stage as pre-authorized, skipping the permission checks applied to user-facing pipeline stages. This trust assumption breaks when an unprivileged client crafts pipelines that reference cursors on collections outside their granted roles.
Attack Vector
Exploitation requires an authenticated session against the MongoDB Server. The attacker submits a crafted aggregation command containing a $mergeCursors stage referencing cursor identifiers or specifications that resolve to unauthorized data. The server executes the merge without cross-checking the caller's roles against the underlying data source, returning documents the user should not see.
No public proof-of-concept is available at the time of publication. See the MongoDB Server Issue SERVER-106752 for vendor technical details.
Detection Methods for CVE-2025-6713
Indicators of Compromise
- Aggregation commands in MongoDB audit logs containing the $mergeCursors stage originating from client applications rather than mongos routing processes.
- Unexpected read activity from low-privilege user accounts targeting collections outside their assigned roles.
- Anomalous cursor identifiers referenced in aggregation pipelines that do not match legitimate sharded query patterns.
Detection Strategies
- Enable MongoDB auditing with the auditLog configuration and filter for aggregation operations that include the $mergeCursors stage.
- Baseline normal aggregation traffic from application service accounts and alert on deviations, particularly pipelines referencing internal stages.
- Correlate authentication events with data access volumes to detect low-privilege accounts pulling atypical dataset sizes.
Monitoring Recommendations
- Forward MongoDB audit logs and diagnostic data to a centralized SIEM for retention and correlation with identity events.
- Monitor role assignments and periodic role changes on MongoDB clusters to reduce the population of accounts able to reach the aggregation interface.
- Track query latency and result-set size anomalies that may indicate bulk data exfiltration through crafted pipelines.
How to Mitigate CVE-2025-6713
Immediate Actions Required
- Upgrade MongoDB Server to version 8.0.7, 7.0.19, or 6.0.22 or later depending on the deployed major release.
- Audit existing database users and revoke unnecessary read privileges, especially on shared clusters with multi-tenant workloads.
- Rotate credentials for any accounts suspected of unauthorized access during the exposure window.
Patch Information
MongoDB has addressed the vulnerability in Server versions 8.0.7, 7.0.19, and 6.0.22. Apply patches following the standard rolling upgrade procedure for replica sets and sharded clusters. Track deployment status via the MongoDB Server Issue SERVER-106752.
Workarounds
- Restrict network exposure of MongoDB instances to trusted application subnets using firewall rules or VPC security groups.
- Enforce the principle of least privilege by scoping user roles to specific databases and collections rather than granting cluster-wide read roles.
- Enable authentication and TLS on all MongoDB endpoints, and disable direct client access to mongos-internal features where feasible.
# Verify installed MongoDB Server version
mongod --version
# Example: audit filter targeting $mergeCursors aggregation usage
# Add to mongod.conf under auditLog.filter
# { atype: "authCheck", "param.command": "aggregate", "param.args.pipeline.$mergeCursors": { $exists: true } }
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
