CVE-2026-13060: MongoDB Auth Bypass Vulnerability

CVE-2026-13060 Overview

CVE-2026-13060 is an authorization bypass vulnerability in MongoDB affecting the $graphLookup aggregation stage. An authenticated user with limited read privileges can access documents from collections they are not authorized to read. The flaw stems from an inconsistency between how MongoDB evaluates $graphLookup during authorization checks and how it evaluates the stage during query execution. Affected scenarios involve collections referenced within existing view pipeline definitions. The vulnerability is classified as an incorrect authorization weakness [CWE-863] and requires network access with low-privilege authentication.

Critical Impact
Authenticated attackers with minimal read privileges can retrieve confidential data from restricted collections referenced by view pipelines, breaking MongoDB's role-based access control boundaries.

Affected Products

MongoDB Server (versions referenced in SERVER-127357)
Deployments using views with $graphLookup in pipeline definitions
Environments relying on collection-level role-based access control

Discovery Timeline

2026-07-22 - CVE-2026-13060 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13060

Vulnerability Analysis

The vulnerability resides in MongoDB's aggregation framework, specifically the $graphLookup stage used for recursive graph traversal across collections. MongoDB performs two separate evaluations of aggregation pipelines. The authorization layer inspects the pipeline to determine which collections the requesting user must have permission to read. The execution layer then processes the pipeline and fetches the referenced documents.

When $graphLookup is embedded inside a view definition, the two evaluations diverge. The authorization check does not resolve the same set of target collections that the execution engine ultimately accesses. This gap allows a user who has read access only to the view, or to unrelated collections, to receive documents from a collection referenced by the view's pipeline. The vulnerability is exploitable over the network without user interaction and requires only low-level authenticated privileges.

Root Cause

The root cause is an inconsistent authorization model for pipeline stages that reference secondary collections. MongoDB validates access based on one view of the pipeline while the aggregation executor operates against a different, expanded view. The $graphLookup operator recursively traverses documents in a from collection, but the authorization pre-check for view pipelines fails to enumerate that traversal target, permitting reads that policy should reject.

Attack Vector

An authenticated user with read access to a view issues an aggregation query that triggers the underlying view pipeline containing $graphLookup. Because the server authorizes the request against an incomplete list of target collections, execution proceeds and returns documents from restricted collections. Exploitation does not require elevated privileges, specialized tooling, or social engineering. The attacker only needs a valid database credential and knowledge of, or the ability to enumerate, view names.

No public proof-of-concept code is available. See the MongoDB Bug Report SERVER-127357 for technical details from the vendor.

Detection Methods for CVE-2026-13060

Indicators of Compromise

Aggregation queries from low-privilege accounts targeting views whose pipelines contain $graphLookup stages
MongoDB audit log entries showing successful reads against collections the authenticated principal has no direct find grant on
Unusual volumes of aggregate commands referencing views followed by exports or $out/$merge writes

Detection Strategies

Enable MongoDB auditing and log all authCheck and aggregate operations, then correlate the authenticated user's granted roles against the collections actually accessed during execution
Inventory all views in the cluster and flag any whose pipeline definitions include $graphLookup, $lookup, or $unionWith referencing sensitive collections
Baseline normal aggregation patterns per role and alert on deviations, particularly reads that cross collection boundaries

Monitoring Recommendations

Forward MongoDB audit logs to a centralized SIEM and build detections for authorization mismatches between requested and accessed collections
Monitor for repeated aggregate calls targeting the same view from a single principal, which may indicate enumeration
Track schema and role changes so newly introduced views containing $graphLookup are reviewed before deployment

How to Mitigate CVE-2026-13060

Immediate Actions Required

Apply the fixed MongoDB Server release referenced in SERVER-127357 as soon as it is available for your deployment channel
Audit all views in production clusters and remove or rewrite any pipelines that use $graphLookup against sensitive collections until patched
Review user and role grants and revoke read access to views that expose restricted data through pipeline stages

Patch Information

MongoDB tracks the fix in SERVER-127357. Administrators should consult the vendor advisory for the specific patched versions and apply the corresponding upgrade for their release train. Test upgrades in a staging environment before rolling to production replica sets and sharded clusters.

Workarounds

Replace $graphLookup inside view definitions with application-side traversal logic executed under a service account with explicit permissions
Restrict view creation privileges to trusted administrators and require code review of any pipeline referencing secondary collections
Enforce least-privilege roles so that low-trust accounts cannot query views whose pipelines touch confidential collections

bash

# Enumerate views that reference $graphLookup for remediation review
mongosh --quiet --eval '
  db.getMongo().getDBNames().forEach(function(name) {
    if (["admin","local","config"].indexOf(name) !== -1) return;
    const d = db.getSiblingDB(name);
    d.getCollectionInfos({ type: "view" }).forEach(function(v) {
      const pipeline = JSON.stringify(v.options.pipeline || []);
      if (pipeline.indexOf("$graphLookup") !== -1) {
        print(name + "." + v.name + " -> " + pipeline);
      }
    });
  });
'