CVE-2026-13058 | An authenticated user with basic write privileges can cause … | CVSS 7.1 HIGH

Description

An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

Metadata

CVE ID: CVE-2026-13058
State: PUBLISHED
Assigner: mongodb
Reserved: 2026-06-23 18:00 UTC
Published: 2026-07-22 19:21 UTC
Last updated: 2026-07-22 19:21 UTC
Primary CWE: CWE-617
CWE-617: Reachable Assertion
Vendor / Product: MongoDB / MongoDB Server
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products (1)

Vendor	Product	Platform	Versions
MongoDB	MongoDB Server	—	8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7

Weakness (CWE)

CWE	Source	Description
CWE-617	cna	CWE-617: Reachable Assertion

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References (1)

https://jira.mongodb.org/browse/SERVER-127661