CVE-2026-13071: MongoDB mongod RCE Vulnerability

CVE-2026-13071 Overview

CVE-2026-13071 affects the MongoDB mongod process. An authenticated user with read access can terminate the database process by submitting crafted aggregation expressions that execute server-side JavaScript. The vulnerability stems from improper memory handling during document processing, mapped to [CWE-416] Use-After-Free. Exploitation results in a denial-of-service condition against the database service.

Critical Impact
Any account holding read privileges can crash the mongod process remotely over the network, disrupting availability for all database consumers.

Affected Products

MongoDB Server (mongod) — specific versions tracked in MongoDB Jira issue SERVER-128473
Deployments that permit server-side JavaScript execution in aggregation pipelines
Any MongoDB instance reachable by authenticated read-role users

Discovery Timeline

2026-07-22 - CVE-2026-13071 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13071

Vulnerability Analysis

The flaw resides in the aggregation framework of mongod when it evaluates expressions that invoke server-side JavaScript, such as $where, $function, or $accumulator. During document processing, memory tied to intermediate values is released while other execution paths still reference it. When those paths dereference the freed memory, the process aborts.

An authenticated attacker submits a crafted aggregation pipeline against a collection they can read. The pipeline forces the JavaScript engine into the vulnerable code path, triggering the memory error and terminating the daemon. Repeated requests prevent the service from staying online, producing a sustained denial of service.

The issue affects confidentiality and integrity minimally but has a direct effect on availability. Because authentication with read access is a common privilege in shared clusters, the attack surface includes application service accounts and any tenant with query permissions.

Root Cause

The root cause is a use-after-free condition ([CWE-416]) in the aggregation execution path that handles server-side JavaScript. Object lifetimes for values crossing the C++ and JavaScript execution boundary are not tracked consistently, so a freed buffer can be referenced later during document processing.

Attack Vector

The attack vector is network-based and requires low privileges and no user interaction. The attacker connects to the MongoDB endpoint, authenticates with a read role, and issues an aggregation query containing the malformed JavaScript expression. Technical specifics are tracked in MongoDB Jira Issue SERVER-128473. No verified public exploit code is available at time of writing.

Detection Methods for CVE-2026-13071

Indicators of Compromise

Unexpected mongod process crashes accompanied by fatal assertion or segmentation fault entries in the MongoDB log
Repeated aggregation commands containing $where, $function, or $accumulator operators from a single authenticated user
Cluster failover or replica set elections triggered without corresponding hardware or network events

Detection Strategies

Enable MongoDB audit logging and alert on aggregation commands that use server-side JavaScript operators from non-application accounts
Correlate mongod restart events with the last executed query in the profiler collection (system.profile)
Baseline normal aggregation traffic per service account and flag statistical deviations in query shape or frequency

Monitoring Recommendations

Ship mongod logs and audit events to a centralized SIEM for correlation with authentication telemetry
Track process uptime, crash counts, and replica set state transitions as availability signals
Monitor authenticated sessions that invoke $where, $function, $accumulator, or mapReduce and alert on unexpected sources

How to Mitigate CVE-2026-13071

Immediate Actions Required

Apply the MongoDB patched release referenced in MongoDB Jira Issue SERVER-128473 as soon as it is available for your deployment channel
Audit user roles and revoke read access from accounts that do not require it
Restrict network exposure of mongod endpoints to trusted application subnets only

Patch Information

MongoDB tracks the fix in Jira ticket SERVER-128473. Refer to the vendor advisory for the exact fixed versions across MongoDB Server release trains. Update all replica set members and shard nodes to the patched build and validate cluster health after the rolling upgrade.

Workarounds

Disable server-side JavaScript execution by starting mongod with --noscripting or setting security.javascriptEnabled: false in the configuration file
Remove or restrict privileges that allow use of $where, $function, $accumulator, and mapReduce through custom roles
Place a query-aware proxy in front of MongoDB to reject aggregation pipelines containing JavaScript operators until patching completes

bash

# Disable server-side JavaScript in mongod.conf
security:
  javascriptEnabled: false

# Or start mongod with the flag
mongod --config /etc/mongod.conf --noscripting