CVE-2026-13055 Overview
CVE-2026-13055 is a denial-of-service (DoS) vulnerability in MongoDB mongod. Any authenticated user with permission to run an aggregation pipeline can invoke the $_internalIndexKey aggregation expression to crash the server. The expression does not correctly handle compound wildcard index specifications, which triggers an internal consistency check that aborts the mongod process ([CWE-617] Reachable Assertion).
The flaw affects database availability without impacting confidentiality or integrity. Because low-privilege authenticated accounts can trigger the crash, tenant isolation and shared cluster environments are particularly exposed.
Critical Impact
Authenticated attackers can terminate the mongod process on demand, causing service outages and forced failovers in production MongoDB deployments.
Affected Products
- MongoDB Server (mongod) — versions supporting the $_internalIndexKey aggregation expression with compound wildcard indexes
- Deployments that expose the aggregation pipeline to authenticated users
- Multi-tenant MongoDB clusters where low-privilege accounts can execute aggregations
Discovery Timeline
- 2026-07-22 - CVE-2026-13055 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-13055
Vulnerability Analysis
The vulnerability resides in the aggregation framework of mongod. The $_internalIndexKey expression is an internal aggregation operator that computes the index key values a document would produce for a given index specification. When the specification describes a compound wildcard index, the expression path does not handle the multi-component wildcard layout correctly.
Instead of returning an error to the client, the code reaches an internal invariant check. That assertion is designed to catch impossible states during development and terminates the process when it fails. As a result, a single crafted aggregation stage causes the entire mongod instance to abort.
The attacker requires only network access to the database and authenticated credentials with rights to run an aggregation pipeline. No administrative privileges are needed and no user interaction is required.
Root Cause
The root cause is missing input validation for compound wildcard index specifications inside $_internalIndexKey. The operator assumes an index shape that compound wildcard indexes do not satisfy. When the mismatch is detected downstream, the code executes an invariant/assertion that aborts the process rather than raising a recoverable user error. This is a classic reachable-assertion defect ([CWE-617]).
Attack Vector
An attacker authenticates to the MongoDB instance with any account that can run aggregations. The attacker submits an aggregation pipeline that uses the $_internalIndexKey expression referencing a compound wildcard index specification. The server begins evaluating the expression, hits the internal consistency check, and terminates mongod.
In a replica set, the primary crashes and clients experience failover latency. Repeated invocation against the newly elected primary produces a rolling outage across the cluster. See the MongoDB Jira Issue SERVER-123081 for vendor-tracked details.
Detection Methods for CVE-2026-13055
Indicators of Compromise
- Unexpected mongod process termination followed by automatic restart, especially on the primary of a replica set
- Server logs containing invariant or fatal assertion messages from the aggregation framework immediately before shutdown
- Aggregation commands from authenticated users containing the $_internalIndexKey expression, which is an internal operator not intended for client use
- Client-side errors indicating dropped connections and replica set elections without a network or hardware cause
Detection Strategies
- Enable MongoDB audit logging and alert on any aggregation command that references $_internalIndexKey in the pipeline
- Correlate mongod crash events with the last executed command from the same client session to identify the triggering user
- Baseline aggregation operator usage per application role and flag deviations, particularly the use of internal $_ prefixed operators
Monitoring Recommendations
- Monitor mongod process uptime and unplanned restarts across all replica set members
- Track replica set election frequency; a spike may indicate repeated crashes of the primary
- Ingest MongoDB audit and diagnostic logs into a centralized SIEM and alert on assertion failures in the aggregation subsystem
How to Mitigate CVE-2026-13055
Immediate Actions Required
- Apply the fixed MongoDB Server release once available from the vendor and track progress via MongoDB Jira Issue SERVER-123081
- Audit database users and remove aggregation privileges from accounts that do not require them
- Restrict network access to mongod to trusted application hosts using firewall rules and MongoDB bindIp settings
- Review compound wildcard index definitions and confirm they are required for production workloads
Patch Information
MongoDB tracks the fix under MongoDB Jira Issue SERVER-123081. Consult that ticket and MongoDB security advisories for the specific server versions containing the corrected $_internalIndexKey handling, then upgrade all replica set members and sharded cluster nodes to a fixed release.
Workarounds
- Enforce role-based access control (RBAC) so only trusted service accounts can execute aggregation pipelines
- Filter or reject client aggregation requests that reference internal $_ prefixed expressions at an application proxy or query gateway
- Remove or avoid compound wildcard index specifications until the fixed server release is deployed
- Enable automatic mongod restart and replica set failover to reduce outage duration while patches are staged
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
