Vulnary
← back to the feed
Critical· 9.2

CVE-2026-13072

A critical vulnerability in MongoDB’s compute mode can corrupt memory during aggregation, potentially crashing the database. The flaw occurs only when compute mode is explicitly enabled and untrusted BSON data is processed. Attackers could exploit this to cause denial of service or other unintended behavior.

publishedJul 22, 2026
last modifiedJul 24, 2026
sourcesNVD
severity · cvss
9.2
critical · how bad it is
exploitation · epss
<1%
24th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 5, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

Standalone mongod instances that have compute mode enabled. Typical users are database administrators running MongoDB in standalone mode.

02

Real-world impact

An attacker could send specially crafted BSON data to a MongoDB server with compute mode enabled, causing the server process to crash or behave unpredictably, leading to denial of service or potential data loss.

03

Why this severity

The CVSS score of 9.2 reflects the high impact of memory corruption that can terminate the process, combined with the fact that the vulnerability is exploitable over the network with no authentication required. The vector shows high attack complexity but no user interaction, making it a serious threat.

04

What to do about it

no official fix yet
interim mitigations
  • Do not enable compute mode unless absolutely necessary.
  • Ensure that any data processed by aggregation pipelines comes from trusted sources or is properly validated.

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources.

05

Timeline

06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityHigh
Attack requirementsPresent
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →