Server-Side JavaScript Vulnerability in MongoDB Affects User Access Control
CVE-2026-13071

7.1HIGH

Key Information:

Vendor

Mongodb
Status
Mongodb Server
Vendor
CVE Published:
22 July 2026

What is CVE-2026-13071?

An authenticated user with read access can exploit a vulnerability in MongoDB by executing specific aggregation expressions that invoke server-side JavaScript. This can lead to the termination of the 'mongod' process, exposing the system to potential denial of service. The vulnerability arises from improper handling of memory during document processing, which may allow unauthorized disruptions to database services. Ensuring that MongoDB is updated to the latest version is crucial to mitigate this risk.

Affected Version(s)

MongoDB Server 7.0 < 7.0.39

MongoDB Server 8.0 < 8.0.28

MongoDB Server 8.2.0 < 8.2.12

References

https://jira.mongodb.org/browse/SERVER-128473

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.