CVE-2026-13072: MongoDB Compute Mode DoS Vulnerability

CVE-2026-13072 Overview

CVE-2026-13072 is a heap-based memory corruption vulnerability [CWE-122] affecting MongoDB standalone mongod instances running with compute mode enabled. The flaw stems from insufficient validation of externally sourced Binary JSON (BSON) data during aggregation pipeline processing. Attackers can send crafted BSON payloads that corrupt heap memory, triggering process termination or other unintended behavior. The vulnerable configuration is non-default and requires explicit enablement at server startup. Because compute mode is invoked over the network without prior authentication requirements in the affected code path, remote unauthenticated attackers can reach the vulnerable component.

Critical Impact
Remote attackers can corrupt heap memory in MongoDB standalone mongod processes running with compute mode enabled, causing service disruption and potential integrity impact to database operations.

Affected Products

MongoDB Server (mongod) standalone deployments
Instances started with compute mode explicitly enabled
Configurations processing externally sourced BSON via aggregation pipelines

Discovery Timeline

2026-07-22 - CVE-2026-13072 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13072

Vulnerability Analysis

The vulnerability resides in the aggregation pipeline execution path used by mongod when compute mode is enabled. Compute mode extends server-side processing capabilities to run computational workloads directly within the database engine. During aggregation stages, the server deserializes BSON documents sourced from client requests or upstream pipeline operators. The affected code path does not fully validate structural or length fields within BSON elements before performing memory operations on heap-allocated buffers. This mismatch between declared and actual BSON element sizes results in a heap-based buffer overflow classified under [CWE-122].

Root Cause

The root cause is insufficient bounds checking of untrusted BSON input consumed by aggregation pipeline stages. BSON encodes documents as length-prefixed binary structures. When the parser trusts attacker-controlled length or type fields without cross-validating them against actual payload boundaries, subsequent copy or transform operations write past the allocated heap region. The issue is scoped to compute mode because that execution path exposes aggregation operators that operate on externally supplied BSON without the sanitization applied elsewhere.

Attack Vector

A remote attacker sends a malformed BSON payload to an exposed mongod instance running in compute mode. The payload passes through an aggregation pipeline stage that invokes the vulnerable parser. The corrupted heap state causes immediate process termination in the simplest case, producing a denial-of-service outcome. Skilled adversaries may leverage the memory corruption primitive for higher-impact outcomes affecting confidentiality and integrity of database state. The attack complexity is elevated because compute mode is non-default and the payload must satisfy pipeline parsing preconditions before reaching the vulnerable code.

No verified public exploit code is available. Technical details are tracked in the MongoDB Jira Issue SERVER-128494.

Detection Methods for CVE-2026-13072

Indicators of Compromise

Unexpected mongod process crashes or restarts correlated with inbound aggregation queries
Core dumps or segmentation fault entries referencing BSON parsing frames in mongod logs
Sudden gaps in database availability metrics on standalone instances configured with compute mode
Anomalous BSON payload sizes or malformed document structures in query audit logs

Detection Strategies

Inventory MongoDB deployments and flag any standalone mongod instance started with compute mode enabled
Enable MongoDB audit logging and inspect aggregation pipeline invocations from unauthenticated or unexpected source addresses
Correlate mongod crash events with preceding network traffic patterns to identify probe attempts
Monitor for repeated connection resets from clients issuing aggregation commands

Monitoring Recommendations

Alert on mongod process termination events and unexpected restarts on database hosts
Track BSON parsing errors and malformed document exceptions in server logs
Monitor network connections to MongoDB ports from untrusted network segments
Capture memory diagnostics from crashed instances for post-incident analysis

How to Mitigate CVE-2026-13072

Immediate Actions Required

Disable compute mode on standalone mongod instances if it is not required for operational workloads
Restrict network exposure of MongoDB services to trusted application tiers using firewall rules or private networking
Enforce authentication and role-based access control on all MongoDB deployments
Review the MongoDB Jira Issue SERVER-128494 for fixed version guidance and apply vendor updates when available

Patch Information

Refer to the MongoDB Jira Issue SERVER-128494 for the authoritative list of fixed releases. Upgrade affected standalone mongod instances to a patched version once released by MongoDB. Validate patch application by confirming the running server version matches or exceeds the fixed release identifier documented in the vendor advisory.

Workarounds

Start mongod without compute mode enabled by removing the corresponding startup flag or configuration directive
Deploy MongoDB behind network access controls that permit only trusted client subnets to reach the database port
Terminate untrusted client connections at an application gateway that validates BSON payload structure before forwarding queries
Use replica set or sharded deployments where operational requirements allow, since the advisory scopes the flaw to standalone instances

bash

# Configuration example: start mongod without compute mode
mongod --config /etc/mongod.conf

# /etc/mongod.conf - ensure compute mode is not enabled
# Remove or comment any directive enabling compute mode
net:
  bindIp: 127.0.0.1,10.0.0.5
  port: 27017
security:
  authorization: enabled