VulnerabilityAnalyzed
CVE-2026-13055
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod).
HIGH 7.1EPSS 0.28%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.28% probability · 21th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-617
- Affected
- mongodb/mongodb
- Source
- cna@mongodb.com
References
- https://jira.mongodb.org/browse/SERVER-123081Vendor Advisory, Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.