CVE-2026-13057: Atlas Search Auth Bypass Vulnerability

CVE-2026-13057 Overview

CVE-2026-13057 is an access control bypass vulnerability in the MongoDB server's Atlas Search integration. An authenticated user can bypass per-user access controls when interacting with sharded topologies. The $search and $searchMeta aggregation stages use internal routing fields normally populated only by the trusted router during sharded search planning. Insufficient input validation allows an authenticated client to supply these fields directly, circumventing intended access restrictions. The vulnerability is tracked under CWE-20: Improper Input Validation.

Critical Impact
An authenticated attacker can read data they should not have access to by manipulating internal routing fields in Atlas Search aggregation stages within sharded MongoDB deployments.

Affected Products

MongoDB Server with Atlas Search integration
Sharded MongoDB topologies using $search aggregation
Sharded MongoDB topologies using $searchMeta aggregation

Discovery Timeline

2026-07-22 - CVE-2026-13057 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13057

Vulnerability Analysis

The vulnerability resides in how the MongoDB server processes Atlas Search aggregation stages in sharded deployments. In a sharded topology, a trusted mongos router coordinates search planning across shards. During this planning, the router populates internal routing fields consumed by the $search and $searchMeta stages on individual shards.

The server does not validate whether these internal routing fields originate from the trusted router. An authenticated client can craft an aggregation pipeline that supplies these fields directly. The shards accept the client-provided routing data as if it came from the trusted planner. This bypasses the per-user access controls that the router would otherwise enforce during query planning.

The result is that authenticated users can access indexed content beyond their intended scope. Confidentiality impact is high, while integrity and availability are unaffected.

Root Cause

The root cause is missing input validation on fields that the server implicitly trusts. The design assumed only the router would populate these routing fields, so the shard-side handler did not verify their origin. This trust boundary violation is a classic instance of CWE-20, where server-side code accepts client input in a context expecting internal system input.

Attack Vector

An attacker requires authenticated access to the MongoDB cluster and the ability to issue aggregation queries. The attacker constructs an aggregation with a $search or $searchMeta stage that includes the internal routing fields normally injected by mongos. When the shard processes the aggregation, it honors the supplied routing data and returns results that would otherwise be filtered by per-user access controls. Full technical details are tracked in MongoDB Jira Issue SERVER-126247.

Detection Methods for CVE-2026-13057

Indicators of Compromise

Aggregation queries from non-router clients that include internal Atlas Search routing fields in $search or $searchMeta stages.
Authenticated users accessing indexed documents outside their normal per-user permission boundaries.
Anomalous direct connections to shard nodes bypassing the mongos router.

Detection Strategies

Enable MongoDB audit logging and review aggregation pipelines for $search and $searchMeta stages containing routing fields when the client is not the trusted router.
Correlate authenticated user identities with the volume and scope of Atlas Search results returned to identify access pattern anomalies.
Alert on connections that reach shard mongod processes directly rather than through mongos.

Monitoring Recommendations

Ingest MongoDB audit and diagnostic logs into a centralized analytics platform for baseline and anomaly analysis.
Track query rates for $search and $searchMeta per user account and flag deviations from established baselines.
Monitor network access controls to confirm shard nodes accept connections only from authorized router hosts.

How to Mitigate CVE-2026-13057

Immediate Actions Required

Apply the MongoDB server patch that addresses SERVER-126247 as soon as it is released for your version.
Review per-user access control configurations and confirm that Atlas Search indexes do not expose data beyond the intended user scope.
Restrict direct network access to shard mongod instances so that only mongos routers can connect.

Patch Information

Refer to the MongoDB Jira Issue SERVER-126247 for the authoritative fix status, affected version list, and patched builds. Deploy the corrected server binaries across all shard nodes and routers in the cluster.

Workarounds

Disable Atlas Search usage on sharded clusters until patched builds are deployed if data sensitivity warrants it.
Enforce network segmentation so that only trusted mongos routers can communicate with shard members, reducing the ability of authenticated clients to reach shard endpoints.
Audit and tighten role-based access control (RBAC) so authenticated users have the minimum necessary privileges on collections backed by Atlas Search indexes.

bash

# Restrict shard bindings and enforce authentication in mongod.conf
net:
  bindIp: 127.0.0.1,10.0.0.10
security:
  authorization: enabled
  clusterAuthMode: x509