CVE-2026-13068 Overview
CVE-2026-13068 is an authorization scoping flaw tracked in MongoDB Jira Issue SERVER-128198. An authenticated user granted cursor termination privileges on one database can terminate active cursors on a separate database. The root cause is an authorization check that fails to scope privileges to the correct namespace, classified as [CWE-863] Incorrect Authorization.
The issue affects availability of ongoing query operations for other users. It does not expose data confidentiality but disrupts query workloads across database boundaries within the same deployment.
Critical Impact
An authenticated low-privileged user can interrupt query operations belonging to other users on databases they were not authorized to affect.
Affected Products
- MongoDB Server (see SERVER-128198 for affected versions)
- Deployments granting the killCursors or equivalent cursor termination privilege scoped to a specific database
- Multi-tenant MongoDB clusters where users hold cursor privileges on any single database
Discovery Timeline
- 2026-07-22 - CVE-2026-13068 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-13068
Vulnerability Analysis
The vulnerability resides in the authorization logic that governs cursor termination operations in MongoDB. When a user issues a command to terminate a cursor, the server evaluates whether the caller holds the required privilege. The evaluation does not correctly bind the privilege to the database namespace on which the target cursor was opened.
As a result, a user who was granted cursor termination rights on database A can invoke termination against cursors that belong to database B. Legitimate users running queries on database B observe those cursors close unexpectedly, producing failed reads, aborted aggregations, and degraded application behavior.
The flaw impacts integrity and availability at a limited scope. It does not permit reading of the underlying documents, escalation of roles, or execution of code. Its practical effect is disruption of tenant workloads in shared deployments.
Root Cause
The authorization check compares the caller's privilege set against the operation type without validating that the privilege's resource scope matches the target database. This is a namespace-scoping defect in the access control evaluator, consistent with [CWE-863].
Attack Vector
Exploitation requires network access to the MongoDB endpoint and valid authenticated credentials with cursor termination privileges on any database. No user interaction is required. An attacker enumerates or observes active cursors and issues termination commands targeting cursors outside their authorized namespace.
No verified public exploit code is available. The mechanics are described in prose because MongoDB has not published proof-of-concept material for this issue. See the vendor tracker at SERVER-128198 for engineering details.
Detection Methods for CVE-2026-13068
Indicators of Compromise
- Unexpected CursorNotFound or OperationFailed errors reported by applications reading from databases where the caller has no legitimate administrative activity.
- Audit log entries showing killCursors commands issued by principals whose role grants are scoped to a different database than the target cursor.
- Clusters of terminated cursors across multiple databases originating from a single authenticated session.
Detection Strategies
- Enable MongoDB auditing and log all killCursors operations with the acting principal, source IP, target namespace, and cursor ID.
- Correlate the acting user's granted role scope against the target database of each termination event and alert on mismatches.
- Baseline normal cursor termination volume per user and flag statistical outliers.
Monitoring Recommendations
- Forward MongoDB audit logs to a centralized analytics platform for cross-user correlation.
- Track query failure rates per database and alert on sudden spikes that align with cursor termination events.
- Review role assignments periodically to identify users holding cursor termination privileges beyond operational need.
How to Mitigate CVE-2026-13068
Immediate Actions Required
- Review all role grants that include cursor termination privileges and remove them from accounts that do not require them.
- Restrict cursor termination privileges to trusted database administrators rather than application service accounts.
- Monitor the MongoDB SERVER-128198 tracker for fix version availability and plan an upgrade window.
Patch Information
Refer to MongoDB Jira Issue SERVER-128198 for the fixed release versions and upgrade guidance. Apply the vendor-supplied patch to all replica set members and shards once available. Validate the fix by attempting a cross-database cursor termination with a scoped test account after upgrade.
Workarounds
- Remove the cursor termination action from custom roles until the patched version is deployed.
- Segregate tenants across separate MongoDB deployments where authorization scoping errors cannot cross tenant boundaries.
- Rotate credentials for accounts that previously held broad cursor termination privileges to invalidate any active sessions.
# Review roles that grant killCursors and revoke where unnecessary
mongosh --eval 'db.getSiblingDB("admin").getRoles({rolesInfo: 1, showPrivileges: true}).roles.forEach(r => r.privileges.filter(p => p.actions.includes("killCursors")).forEach(p => print(r.role, JSON.stringify(p.resource))))'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
