CVE-2026-13073 Overview
CVE-2026-13073 is a denial of service vulnerability affecting the MongoDB mongod server process. An authenticated user holding only read-only privileges can crash the process by issuing a crafted aggregation command. The flaw originates from an internal engine selection inconsistency triggered by a specific combination of aggregation options. Once the process terminates, all connected clients lose service until an administrator restarts mongod. The issue is tracked upstream in the MongoDB Server Issue Track (SERVER-128512) and classified under CWE-617 (Reachable Assertion).
Critical Impact
Any authenticated read-only user can remotely terminate the mongod process, causing service disruption for all connected database clients.
Affected Products
- MongoDB Server (mongod) — refer to SERVER-128512 for affected versions
Discovery Timeline
- 2026-07-22 - CVE-2026-13073 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-13073
Vulnerability Analysis
The vulnerability resides in MongoDB's aggregation pipeline execution path. When a client submits an aggregation command that combines specific options, mongod reaches an inconsistent state during internal query engine selection. This inconsistency triggers a reachable assertion, causing the process to terminate abnormally.
Because aggregation queries are a core read operation, the required privilege level is minimal. A user with read-only access to any database can trigger the abort. The result is a full-server denial of service that affects every connected client until an operator restarts the daemon.
Root Cause
The root cause is an internal engine selection inconsistency inside the aggregation framework. The server routes a query through a code path that assumes an invariant which the crafted option combination violates. The violated invariant reaches an assertion, and mongod exits rather than degrading gracefully or returning an error to the client. This behavior maps directly to CWE-617: Reachable Assertion.
Attack Vector
Exploitation requires network access to the MongoDB service and valid credentials with read-only privileges. The attacker connects using any standard MongoDB driver or the mongosh client and issues a single crafted aggregate command. No elevated privileges, user interaction, or write access are required.
The vulnerability manifests through legitimate protocol traffic, so the payload does not require malformed packets or protocol abuse. Refer to the MongoDB Server Issue Track (SERVER-128512) for the specific aggregation option combination.
Detection Methods for CVE-2026-13073
Indicators of Compromise
- Unexpected mongod process termination entries in the MongoDB server log, particularly assertion failures or fatal messages preceding shutdown.
- Repeated client reconnection attempts and NetworkError events across drivers immediately following an aggregation command.
- Aggregation commands originating from read-only accounts that consistently precede a mongod restart in the audit log.
Detection Strategies
- Enable MongoDB auditing and log all aggregate commands, correlating command timestamps with process start events.
- Alert on mongod process exits that are not preceded by an administrative shutdown command.
- Baseline aggregation patterns per service account and flag read-only users issuing unusual aggregation option combinations.
Monitoring Recommendations
- Monitor mongod uptime metrics and generate alerts when uptime resets outside of scheduled maintenance windows.
- Forward MongoDB audit logs and system logs to a centralized SIEM for correlation of user activity with process crashes.
- Track connection churn on database ports to identify mass client reconnections that indicate a server restart.
How to Mitigate CVE-2026-13073
Immediate Actions Required
- Apply the fixed MongoDB Server release referenced in SERVER-128512 as soon as it is available for your deployment channel.
- Audit database user accounts and remove unused read-only accounts, especially those accessible from broad network segments.
- Restrict network exposure of mongod to trusted application hosts using firewall rules or private network configuration.
Patch Information
MongoDB tracks the fix in the MongoDB Server Issue Track (SERVER-128512). Consult the linked ticket and MongoDB release notes for the specific server versions containing the corrected engine selection logic, and plan an upgrade for both primary and secondary replica set members.
Workarounds
- Enforce least privilege and limit which accounts can execute aggregate commands, revoking access from service identities that do not require it.
- Deploy MongoDB as a replica set so that a crashed primary triggers automatic failover and reduces client-visible downtime.
- Place mongod behind a database proxy or connection pooler that rate-limits aggregation traffic and can throttle suspicious clients.
# Example: restrict a user to a specific database with read-only access
# and remove aggregation privileges from untrusted roles.
use admin
db.revokeRolesFromUser("reporting_user", [ { role: "read", db: "production" } ])
db.grantRolesToUser("reporting_user", [ { role: "read", db: "reporting_replica" } ])
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
