CVE-2026-13061: Session Metadata Disclosure Vulnerability

CVE-2026-13061 Overview

CVE-2026-13061 is an authorization flaw in MongoDB that allows an authenticated user to view session metadata belonging to other users through the $listSessions aggregation stage. This information is normally restricted to accounts with cluster-level administrative privileges. Exposed metadata includes active session identifiers, associated usernames, and activity timestamps. The weakness is classified under [CWE-863: Incorrect Authorization]. The issue is tracked publicly through MongoDB Jira Issue SERVER-127689.

Critical Impact
Authenticated low-privilege users can enumerate session identifiers, usernames, and activity timestamps of other database users, enabling reconnaissance for follow-on attacks against MongoDB clusters.

Affected Products

MongoDB Server (see MongoDB Jira SERVER-127689 for affected versions)
Deployments exposing the $listSessions aggregation stage to non-administrative accounts
MongoDB clusters where session metadata is considered sensitive

Discovery Timeline

2026-07-22 - CVE-2026-13061 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13061

Vulnerability Analysis

The vulnerability resides in how MongoDB enforces access control on the $listSessions aggregation pipeline stage. This stage is designed to return active session data for administrative visibility. Under correct enforcement, only users with cluster-level administrative roles such as clusterMonitor should see sessions belonging to other users.

The defect allows any authenticated user to invoke the stage and receive session metadata across the cluster. Returned fields include session identifiers, associated user principals, and last-use timestamps. While the disclosed data does not include credentials or query payloads, it provides direct reconnaissance value for attackers already inside the trust boundary.

Root Cause

The root cause is an authorization gap in the aggregation stage's permission check. The server does not consistently verify that the requesting principal holds the required cluster-level role before returning session records belonging to other users. This is a classic [CWE-863] incorrect authorization pattern, where a privileged operation is exposed to lower-privileged callers.

Attack Vector

Exploitation requires an authenticated account on the target MongoDB deployment and network reachability to the database endpoint. No user interaction is needed. An attacker with any valid credential can issue an aggregation pipeline containing $listSessions and receive session records for other users, including administrators. The disclosed usernames and session identifiers support targeted credential attacks, session correlation, and lateral movement planning.

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been documented. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-13061

Indicators of Compromise

Aggregation queries containing the $listSessions stage issued by roles other than clusterMonitor, root, or equivalent administrative principals.
Unusual enumeration of session identifiers followed by authentication attempts against the discovered usernames.
Repeated aggregate commands against the admin.$cmd.aggregate namespace from application service accounts.

Detection Strategies

Enable MongoDB audit logging with the authCheck and command filters, then search for $listSessions invocations correlated with non-administrative users.
Baseline which service accounts legitimately use aggregation pipelines and alert on new principals invoking $listSessions.
Ingest MongoDB audit logs into a centralized analytics platform to correlate reconnaissance activity with subsequent authentication anomalies.

Monitoring Recommendations

Forward MongoDB audit and diagnostic logs to a SIEM or data lake for retention and query.
Track spikes in aggregation commands issued from application tier accounts that historically only run CRUD operations.
Monitor for follow-on activity such as new logins from unfamiliar source addresses using usernames recently enumerated via $listSessions.

How to Mitigate CVE-2026-13061

Immediate Actions Required

Upgrade MongoDB Server to the patched release identified in MongoDB Jira SERVER-127689 once available for your branch.
Audit existing database roles and remove aggregation privileges from accounts that do not require them.
Rotate session tokens and review authentication logs for any misuse of enumerated session identifiers.

Patch Information

Refer to MongoDB Jira Issue SERVER-127689 for the authoritative list of fixed versions and release notes. Apply the vendor-supplied patch to all replica set members and mongos routers, then restart affected nodes following the rolling upgrade procedure documented by MongoDB.

Workarounds

Restrict database access to trusted application accounts using the principle of least privilege, and remove unused roles from directory-integrated identities.
Place MongoDB behind network segmentation so that only authorized application tiers can open client connections.
Enable and review MongoDB audit logs to detect use of $listSessions by non-administrative principals until the patch is deployed.

bash

# Example: audit configuration to log aggregation commands in mongod.conf
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: { $in: ["authCheck"] }, "param.command": "aggregate" }'