CVE-2026-13058: MongoDB mongod Process DoS Vulnerability

CVE-2026-13058 Overview

CVE-2026-13058 is a denial-of-service vulnerability in the MongoDB mongod process. An authenticated user with basic write privileges can terminate the server by sending a crafted transaction command that omits required fields. The issue stems from inconsistent validation across related transaction command parameters. When processed, the crafted request triggers a fatal internal invariant failure, classified as a reachable assertion [CWE-617].

Critical Impact
Any authenticated database user with write privileges can remotely crash the mongod process, disrupting availability for all downstream applications relying on the database.

Affected Products

MongoDB Server (mongod) — refer to the MongoDB Issue Tracker Entry for affected version ranges
Deployments accepting transaction commands from low-privileged authenticated users
Replica set and sharded cluster configurations exposing mongod to application traffic

Discovery Timeline

2026-07-22 - CVE-2026-13058 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13058

Vulnerability Analysis

CVE-2026-13058 resides in the transaction command handling path of mongod. MongoDB transaction commands (commitTransaction, abortTransaction, and related operations) require a specific set of session and transaction fields to be present and internally consistent. The server validates some of these fields at the command parser layer but defers validation of related fields until deeper in the execution path.

When an attacker submits a transaction command that satisfies the initial parser checks but omits fields expected by subsequent logic, the server reaches an invariant() assertion. Invariants in MongoDB are treated as unrecoverable conditions and cause the entire mongod process to terminate. The vulnerability is a classic reachable assertion condition [CWE-617] where attacker-controlled input reaches a code path that assumes prior validation.

Root Cause

The root cause is inconsistent validation across transaction command parameters. Individual field checks exist, but no unified validator ensures the combined set of transaction fields is complete before command dispatch. This lets a partially specified command pass early checks and reach code that assumes all fields are present.

Attack Vector

Exploitation requires network access to the MongoDB wire protocol and a valid account with basic write privileges. The attacker constructs a transaction command missing one or more required fields and submits it over an authenticated session. The command triggers the invariant, and the mongod process aborts. In replica sets, the primary crash forces a re-election. Repeated exploitation produces a sustained denial-of-service condition. See the MongoDB Issue Tracker Entry for technical details.

Detection Methods for CVE-2026-13058

Indicators of Compromise

Unexpected mongod process termination with fatal invariant or assertion messages in server logs
Repeated primary re-elections in replica set logs without infrastructure or network cause
Transaction commands originating from low-privileged accounts that do not normally initiate transactions
Client disconnection storms correlated with mongod restart events

Detection Strategies

Alert on mongod log entries containing Fatal assertion, invariant, or abnormal exit codes
Correlate authentication logs with process termination events to identify the originating session
Baseline transaction command usage per user and flag deviations from expected callers
Monitor for the same client repeatedly triggering mongod restarts within short intervals

Monitoring Recommendations

Ship mongod logs to a centralized logging or SIEM platform and retain full command auditing
Enable MongoDB audit logging for authenticate, createCollection, and transaction-related events
Track process uptime and restart counts per replica set member as an availability metric
Review privilege assignments periodically so only required accounts hold write roles

How to Mitigate CVE-2026-13058

Immediate Actions Required

Upgrade mongod to a fixed release identified in the MongoDB Issue Tracker Entry
Audit database roles and revoke write privileges from accounts that do not require them
Restrict network exposure of mongod so only trusted application tiers can reach the wire protocol
Enable authentication and TLS on all cluster members and client-facing endpoints

Patch Information

MongoDB has tracked the fix under issue SERVER-127661. Consult the MongoDB Issue Tracker Entry for the specific patched versions across supported release branches, then apply the corresponding update to standalone servers, replica set members, and sharded cluster components.

Workarounds

Limit accounts holding the built-in readWrite or custom write roles until the patch is deployed
Place mongod behind a network policy that only allows connections from vetted application hosts
Deploy replica set members across failure domains so an induced crash does not remove quorum
Monitor and rate-limit clients that generate malformed transaction commands at the application layer

bash

# Example: revoke write role from a non-essential user until patched
mongosh --eval 'db.getSiblingDB("admin").revokeRolesFromUser("app_reporting", [{ role: "readWrite", db: "analytics" }])'

# Example: restrict mongod bind_ip to internal application subnet
# /etc/mongod.conf
net:
  bindIp: 10.0.10.15
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongod.pem
security:
  authorization: enabled