CVE-2026-13065: MongoDB $linearFill DoS Vulnerability

CVE-2026-13065 Overview

CVE-2026-13065 is a denial-of-service vulnerability in MongoDB's mongod process. A user with read-only privileges can craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type. This crafted input triggers a null pointer dereference [CWE-476], causing the mongod process to terminate abnormally. The root cause is insufficient validation of sort specifications during execution of the aggregation pipeline. The vulnerability is exploitable over the network by an authenticated attacker holding only read privileges.

Critical Impact
An authenticated user with read-only privileges can crash the mongod process remotely, disrupting database availability for all connected applications and clients.

Affected Products

MongoDB Server (mongod)
Deployments exposing the aggregation framework to read-only users
Environments permitting $linearFill window function operator usage

Discovery Timeline

2026-07-22 - CVE-2026-13065 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13065

Vulnerability Analysis

The vulnerability resides in the execution path of MongoDB's aggregation framework, specifically within the $linearFill window function operator. $linearFill interpolates missing numeric values along an ordered window and requires a sortBy specification to determine ordering. When a user submits an aggregation pipeline containing $linearFill with a specific unsupported or malformed sortBy expression type, mongod fails to validate the specification before dereferencing an internal pointer derived from it. The result is a null pointer dereference [CWE-476] that crashes the server process. Because the operator is available to any user holding read privileges on the target collection, exploitation does not require elevated permissions. Successful exploitation impacts availability only; confidentiality and integrity remain intact according to the published CVSS vector.

Root Cause

The root cause is insufficient validation of the sortBy expression type within the $linearFill operator's execution logic. The code path assumes a valid, expected sort specification structure and does not defensively handle unexpected expression types before use, leading to dereference of an uninitialized or null internal object.

Attack Vector

An attacker authenticates to the MongoDB instance with any account holding read privileges on a target collection. The attacker issues an aggregate command containing a $setWindowFields stage that invokes $linearFill with a crafted sortBy expression. Processing the malformed specification triggers the crash, terminating mongod and denying service to all clients. Refer to MongoDB Jira Issue SERVER-127280 for authoritative technical details.

Detection Methods for CVE-2026-13065

Indicators of Compromise

Unexpected mongod process termination or restart events without administrative action.
MongoDB server logs showing fatal errors or crash dumps referencing $linearFill or $setWindowFields stages.
Repeated aggregate command entries from a single authenticated user immediately preceding a crash.
Client connection resets and application-side database errors correlated with mongod restarts.

Detection Strategies

Enable MongoDB profiling and audit logging to capture the full text of aggregation commands, including operator names and sortBy clauses.
Alert on mongod service restarts, abnormal exit codes, and generation of crash dump files.
Search database audit logs for aggregate operations containing $linearFill submitted by read-only role holders.

Monitoring Recommendations

Monitor mongod uptime, connection counts, and process exit signals through infrastructure monitoring tooling.
Track per-user aggregation command volume and flag anomalous spikes from low-privilege accounts.
Forward MongoDB audit logs to a centralized SIEM for correlation with authentication and network events.

How to Mitigate CVE-2026-13065

Immediate Actions Required

Apply the patched MongoDB release once available from the vendor for your deployed version.
Audit database users and remove unnecessary read privileges on collections exposed to untrusted clients.
Restrict network exposure of mongod to trusted application tiers only.
Review recent audit logs for $linearFill usage by non-administrative accounts.

Patch Information

MongoDB has tracked the fix under MongoDB Jira Issue SERVER-127280. Consult the official MongoDB security advisories and release notes to identify the specific patched versions applicable to your deployment channel and upgrade accordingly.

Workarounds

Revoke aggregation privileges from accounts that do not require analytical query capabilities.
Use a proxy or query filtering layer to reject aggregation pipelines containing $linearFill until patched.
Deploy replica sets and automatic failover so that a single mongod crash does not result in extended downtime.

bash

# Configuration example: revoke read role and grant a restricted custom role
# that excludes aggregation privileges on sensitive collections
mongosh --eval '
  use admin;
  db.revokeRolesFromUser("appReader", [{ role: "read", db: "prod" }]);
  db.createRole({
    role: "restrictedRead",
    privileges: [
      { resource: { db: "prod", collection: "" }, actions: ["find"] }
    ],
    roles: []
  });
  db.grantRolesToUser("appReader", [{ role: "restrictedRead", db: "admin" }]);
'