Access Control Bypass in Atlas Search Integration by MongoDB

CVE-2026-13057

What is CVE-2026-13057?

A vulnerability in MongoDB's Atlas Search integration enables an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages utilize internal routing mechanisms that should typically be populated solely by the trusted router during sharded search planning. However, due to inadequate input validation, an authenticated client can directly supply these fields, potentially leading to unauthorized access to sensitive data. This flaw highlights the necessity for rigorous validation processes to ensure robust access controls in database management systems.

References