CVE-2026-13075: MongoDB DoS Vulnerability via Aggregation

CVE-2026-13075 Overview

CVE-2026-13075 is a denial-of-service vulnerability in MongoDB's mongod server process. An authenticated user can trigger operating system termination of the mongod process under memory pressure by submitting aggregation queries containing the $rankFusion and $scoreFusion stages. The issue originates in the server's error-handling path and requires authenticated access with permission to run aggregation queries. The flaw is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling) and affects availability of the database service.

Critical Impact
Authenticated attackers can force the operating system to kill the mongod process, causing database unavailability and disrupting dependent applications.

Affected Products

MongoDB Server (mongod) versions supporting the $rankFusion aggregation stage
MongoDB Server (mongod) versions supporting the $scoreFusion aggregation stage
Refer to MongoDB Jira Issue SERVER-128316 for specific affected versions

Discovery Timeline

2026-07-22 - CVE-2026-13075 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13075

Vulnerability Analysis

The vulnerability resides in MongoDB's aggregation framework, specifically in the code paths that handle the $rankFusion and $scoreFusion stages. These stages combine multiple ranked or scored result sets from subqueries into a fused output. When errors occur during execution, the server's error-handling path fails to release or bound the memory consumed by intermediate result sets.

Under sustained query load, memory usage grows until the host operating system invokes its out-of-memory (OOM) killer. The kernel then terminates the mongod process to reclaim memory. Because the flaw resides server-side, replica set members processing the malicious aggregation are equally affected, which can cascade into cluster-wide unavailability.

Root Cause

The root cause is unbounded resource allocation during aggregation error handling, mapped to [CWE-770]. The $rankFusion and $scoreFusion operators materialize intermediate result sets without enforcing hard memory limits when the error path is triggered. Without size guards, an authenticated caller can shape input to keep allocations growing until the OS terminates the process.

Attack Vector

Exploitation requires network access to the MongoDB server and authenticated credentials with the find or aggregation privileges on a target collection. The attacker issues a crafted aggregation pipeline containing $rankFusion or $scoreFusion stages designed to trigger the vulnerable error path. Repeated invocation drives host memory pressure until the kernel terminates mongod. No user interaction is required beyond authenticated query submission. Technical details are tracked in MongoDB Jira Issue SERVER-128316.

Detection Methods for CVE-2026-13075

Indicators of Compromise

Unexpected mongod process termination entries in system logs, particularly oom-killer messages in /var/log/messages or dmesg output naming mongod as the killed process.
MongoDB server logs showing repeated aggregation queries that reference $rankFusion or $scoreFusion stages from a single authenticated user immediately before a crash.
Sudden spikes in resident set size (RSS) for the mongod process without a corresponding workload increase.

Detection Strategies

Enable MongoDB profiling (db.setProfilingLevel(1)) and audit slow or memory-intensive aggregation commands referencing $rankFusion or $scoreFusion.
Correlate mongod restart events with kernel OOM messages to identify externally induced terminations.
Alert on authenticated users issuing aggregation stages that are not part of normal application query patterns.

Monitoring Recommendations

Track host-level memory metrics for MongoDB nodes and alert on rapid consumption tied to database processes.
Monitor mongod uptime and restart counts across replica set members to catch cluster-wide instability.
Ingest MongoDB audit logs into a centralized SIEM to trace the originating client IP, user, and pipeline shape for suspicious aggregations.

How to Mitigate CVE-2026-13075

Immediate Actions Required

Upgrade mongod to a fixed release once MongoDB publishes the patched versions referenced in SERVER-128316.
Review and tighten role-based access control so only trusted service accounts hold aggregation privileges on production collections.
Rotate credentials of any user account observed issuing anomalous $rankFusion or $scoreFusion pipelines.

Patch Information

MongoDB tracks the fix under MongoDB Jira Issue SERVER-128316. Consult the ticket and MongoDB security advisories for the exact fixed versions across supported release branches, then apply upgrades to primary and secondary replica set members following standard rolling-upgrade procedures.

Workarounds

Restrict use of $rankFusion and $scoreFusion at the application layer until patched binaries are deployed.
Enforce per-user query resource limits using MongoDB roles and application-level query gateways to block unapproved aggregation stages.
Configure host cgroup memory limits and process supervision so mongod restarts quickly if terminated, reducing outage duration.

bash

# Configuration example: revoke broad aggregation rights and grant a scoped role
use admin
db.createRole({
  role: "restrictedAggRole",
  privileges: [
    { resource: { db: "appdb", collection: "" }, actions: [ "find" ] }
  ],
  roles: []
})
db.revokeRolesFromUser("appuser", [ { role: "readWrite", db: "appdb" } ])
db.grantRolesToUser("appuser", [ { role: "restrictedAggRole", db: "admin" } ])