Vulnerabilities

CVSS

6.5 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Risk score

52.0

Published

2026-07-22

Status

Analyzed

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

Weaknesses

CWE-617

Coverage 1

vulnerability

Multiples vulnérabilités dans MongoDB (24 juillet 2026)

Multiple vulnerabilities have been discovered in MongoDB, allowing an attacker to cause a denial of service and potentially exploit a security policy bypass. These vulnerabilities affect various versions of MongoDB Compa…

CERT-FR · Jul 24, 2026 High

CVE-2026-13055CVE-2026-13056CVE-2026-13057mongodbvulnerabilitysecurity

All articles mentioning it

Advisories and references

• jira.mongodb.org/browse/SERVER-123081