CVE-2026-13055

MEDIUM

Server crash via aggregation pipeline expression with compound wildcard index specification

Title source: cna

Description

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

References (1)

Core 1

Core References

https://jira.mongodb.org/browse/SERVER-123081

Scores

CVSS v3 6.5

EPSS 0.0029

EPSS Percentile 21.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-617

Status published

Products (4)

MongoDB/MongoDB Server 7.0 - 7.0.39

MongoDB/MongoDB Server 8.0 - 8.0.28

MongoDB/MongoDB Server 8.2.0 - 8.2.12

MongoDB/MongoDB Server 8.3.0 - 8.3.7

Published Jul 22, 2026

Tracked Since Jul 23, 2026