CVE-2026-13055CWE-617

CVE-2026-13055

Medium · published July 23, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-07-23T00:16Z
Affected products (4)
ProductVersionsFixed in
mongodb/mongodb≥ 7.0.0, < 7.0.397.0.39
mongodb/mongodb≥ 8.0.0, < 8.0.288.0.28
mongodb/mongodb≥ 8.2.0, < 8.2.128.2.12
mongodb/mongodb≥ 8.3.0, < 8.3.78.3.7
References (1)
https://jira.mongodb.org/browse/SERVER-123081 · [email protected]
EPSS history
Timeline
  • 22 JUL 19:22Z
    Server crash via aggregation pipeline expression with compound wildcard index specification
    cvelistv5