CVE-2026-13059: Authentication Bypass Vulnerability

CVE-2026-13059 Overview

CVE-2026-13059 is an authorization bypass vulnerability in MongoDB affecting role-based query-level access controls. An authenticated user with low privileges can perform unauthorized reads and writes on protected data. The flaw stems from insufficient validation of client-supplied command parameters. The issue impacts the find, update, delete, and aggregate commands when the server runs in non-apiStrict configurations. The vulnerability is categorized under [CWE-807] (Reliance on Untrusted Inputs in a Security Decision).

Critical Impact
Low-privileged authenticated users can bypass role-based query-level access controls to read and modify data they should not be able to access, resulting in confidentiality and integrity compromise across affected MongoDB deployments.

Affected Products

MongoDB Server (non-apiStrict configurations)
Deployments exposing find, update, delete, and aggregate commands
Environments enforcing role-based query-level access controls

Discovery Timeline

2026-07-22 - CVE-2026-13059 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13059

Vulnerability Analysis

MongoDB enforces role-based access control (RBAC) at the query level, allowing administrators to restrict which documents and fields authenticated users can read or modify. This vulnerability breaks that boundary. The server accepts certain client-supplied command parameters without adequate validation against the caller's assigned role restrictions. As a result, a low-privileged user can craft find, update, delete, or aggregate commands that operate on data outside their authorized scope. The flaw only manifests in non-apiStrict configurations, where the server permits a broader surface of command options. Because both reads and writes are affected, the vulnerability compromises confidentiality and integrity of protected collections.

Root Cause

The root cause is a trust boundary violation described by [CWE-807]. The MongoDB server relies on untrusted, client-supplied parameters when evaluating whether an operation satisfies query-level access rules. Instead of canonicalizing and re-validating the effective query against the role's restrictions, the server honors options that alter execution semantics in ways the access control layer does not account for. This mismatch allows crafted commands to slip past authorization checks.

Attack Vector

Exploitation requires network access to the MongoDB instance and valid credentials for a low-privileged account. No user interaction is needed. The attacker issues standard database commands with parameter combinations that the access control layer fails to correlate with the enforced restrictions. Successful exploitation returns documents that role-based rules should hide or performs writes on documents the account cannot legitimately modify. Detailed reproduction steps are tracked in the MongoDB Issue Tracker Entry.

Detection Methods for CVE-2026-13059

Indicators of Compromise

Audit log entries showing successful find, update, delete, or aggregate operations executed by low-privileged accounts against collections outside their documented role scope.
Unexpected read volume or write activity from service accounts that historically issue narrow, predictable queries.
Command payloads containing unusual combinations of parameters on servers running with apiStrict disabled.

Detection Strategies

Enable MongoDB auditing and log all authenticated command invocations, including full command parameters, for correlation against role definitions.
Baseline each application account's expected collection access and alert on deviations, especially cross-collection or cross-database activity.
Review query shapes against role-based restriction predicates to identify commands whose effective scope exceeds the caller's permissions.

Monitoring Recommendations

Forward MongoDB audit logs to a centralized analytics platform and retain them long enough to support retrospective investigation.
Alert on privilege-sensitive commands issued outside maintenance windows or from unexpected client IP ranges.
Track failed and succeeded authorization decisions per role and investigate spikes tied to specific accounts or application tiers.

How to Mitigate CVE-2026-13059

Immediate Actions Required

Inventory MongoDB deployments and identify instances running without apiStrict enforcement.
Rotate credentials for low-privileged accounts that access sensitive collections and review recent audit logs for anomalous command activity.
Restrict network exposure of MongoDB to trusted application subnets while remediation is in progress.

Patch Information

Refer to the MongoDB Issue Tracker Entry for the authoritative list of fixed server versions and upgrade guidance. Apply the vendor-supplied patched release for your deployment channel as soon as it becomes available and validate role-based access controls after the upgrade.

Workarounds

Enable apiStrict on client connections where feasible, since the vulnerability is scoped to non-apiStrict configurations.
Tighten role definitions to minimize collection and command exposure for application accounts until patched builds are deployed.
Place a query-aware proxy or application-layer authorization control in front of MongoDB to reject command shapes that fall outside expected patterns.

bash

# Configuration example: require strict API behavior on client connections
mongosh "mongodb://appuser@db.internal:27017/appdb" \
  --apiVersion 1 \
  --apiStrict