CVE-2026-13076: MongoDB Aggregation Framework DoS Flaw

CVE-2026-13076 Overview

CVE-2026-13076 is a denial-of-service vulnerability affecting MongoDB's aggregation framework. An authenticated user with write access and the ability to run aggregation queries can trigger disproportionate memory consumption through a specific data type conversion operation. Under memory pressure, the operating system terminates the mongod process, resulting in service disruption.

The issue is tracked under MongoDB Issue Tracker SERVER-128584 and is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
An authenticated attacker with aggregation query privileges can crash the mongod process by triggering excessive memory allocation, causing database availability loss.

Affected Products

MongoDB Server (mongod) — refer to MongoDB SERVER-128584 for affected version details
Deployments exposing the aggregation framework to authenticated users with write access
MongoDB instances running on memory-constrained hosts where OOM termination is likely

Discovery Timeline

2026-07-22 - CVE-2026-13076 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13076

Vulnerability Analysis

The vulnerability resides in MongoDB's aggregation framework, which processes multi-stage data transformation pipelines. A specific data type conversion operation consumes memory disproportionately relative to the input size. When an authenticated user submits a crafted aggregation query, the mongod process allocates excessive memory during conversion.

When the host reaches memory pressure, the Linux Out-Of-Memory (OOM) killer or equivalent OS mechanism terminates the mongod process. This causes an abrupt service outage for all connected clients. Restart and recovery introduce further downtime, particularly in replica sets where failover must complete before writes resume.

Exploitation requires both write access to the database and permission to execute aggregation queries. The attack does not require administrative privileges, making internal users and compromised application service accounts viable threat sources.

Root Cause

The root cause is unbounded resource consumption [CWE-770] within the aggregation framework's type conversion logic. The operation does not enforce proportionate limits between the input document size and the memory required to produce the converted output. This asymmetric allocation pattern allows a small input to drive large memory growth inside the server process.

Attack Vector

The attack vector is network-based and requires authenticated low-privilege access. An attacker with a valid MongoDB account holding write and aggregation permissions submits a crafted aggregation pipeline containing the vulnerable conversion operator. The pipeline forces mongod to allocate memory until the operating system terminates the process.

The vulnerability manifests entirely server-side during pipeline execution. See the MongoDB SERVER-128584 issue for reproduction context and remediation details. No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-13076

Indicators of Compromise

Unexpected termination of the mongod process with OOM killer entries in /var/log/messages or dmesg output referencing mongod.
Rapid resident set size (RSS) growth of mongod immediately preceding process exit.
Repeated aggregation queries from a single authenticated user containing type conversion operators in unusual volume or patterns.
Replica set failover events correlated with aggregation query traffic from a specific client.

Detection Strategies

Enable MongoDB profiling (db.setProfilingLevel(1)) to capture slow aggregation operations and inspect pipelines using type conversion stages.
Alert on mongod process restarts and correlate with the last executed aggregation queries in the profiler collection.
Monitor host-level OOM killer events targeting database processes through syslog forwarding to a centralized log platform.

Monitoring Recommendations

Track mongod memory metrics (mem.resident, mem.virtual) via serverStatus and alert on sudden spikes.
Log and review aggregation pipeline audit records per authenticated user to identify anomalous conversion operator usage.
Correlate database availability alerts with client session identifiers to attribute exploitation attempts.

How to Mitigate CVE-2026-13076

Immediate Actions Required

Restrict aggregation and write privileges to trusted service accounts using MongoDB role-based access control.
Rotate credentials for any accounts that hold write plus aggregation permissions and are not strictly required.
Review recent aggregation query activity for anomalous type conversion operators against the vulnerable pipeline stage.
Ensure host-level memory limits and process supervision are configured so mongod restarts cleanly after termination.

Patch Information

Refer to the MongoDB Issue Tracker SERVER-128584 for the fixed versions and upgrade guidance. Apply the vendor-supplied patch to all mongod nodes across primary and secondary replica set members. Verify the fix by reviewing the release notes for the patched MongoDB server version.

Workarounds

Revoke the aggregation privilege from accounts that do not require it, limiting the population able to trigger the flaw.
Enforce query governance through application-layer allowlisting of aggregation pipelines rather than exposing arbitrary pipelines to clients.
Configure cgroups memory limits for the mongod process to bound blast radius, accepting that the process will still be terminated under attack.
Deploy replica sets with automated failover so client impact is limited to reconnection latency when a node is terminated.

bash

# Example: Revoke aggregation-capable role from a non-essential user
mongosh --eval 'db.getSiblingDB("admin").revokeRolesFromUser("app_reporting", [{ role: "readWrite", db: "analytics" }])'

# Example: Enable profiling to capture slow aggregation operations for review
mongosh --eval 'db.getSiblingDB("analytics").setProfilingLevel(1, { slowms: 100 })'