Back to overview

CVE-2026-13055

MEDIUM
6.5
CVSS 3.1
Description
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

Metadata

CVE ID
CVE-2026-13055
State
PUBLISHED
Assigner
mongodb
Reserved
2026-06-23 17:59 UTC
Published
2026-07-22 19:22 UTC
Last updated
2026-07-22 19:22 UTC
Primary CWE
CWE-617
CWE-617: Reachable Assertion
Vendor / Product
MongoDB / MongoDB Server
Sources
cve.org  ·  NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
MongoDB MongoDB Server — 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Weakness (CWE)
CWESourceDescription
CWE-617 cna CWE-617: Reachable Assertion
CVSS scores (2)
ScoreSeverityVersionSourceVector
7.1 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A
6.5 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References (1)
Back to overview