CVE-2026-13072
A critical vulnerability in MongoDB’s compute mode can corrupt memory during aggregation, potentially crashing the database. The flaw occurs only when compute mode is explicitly enabled and untrusted BSON data is processed. Attackers could exploit this to cause denial of service or other unintended behavior.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Standalone mongod instances that have compute mode enabled. Typical users are database administrators running MongoDB in standalone mode.
Real-world impact
An attacker could send specially crafted BSON data to a MongoDB server with compute mode enabled, causing the server process to crash or behave unpredictably, leading to denial of service or potential data loss.
Why this severity
The CVSS score of 9.2 reflects the high impact of memory corruption that can terminate the process, combined with the fact that the vulnerability is exploitable over the network with no authentication required. The vector shows high attack complexity but no user interaction, making it a serious threat.
What to do about it
- ›Do not enable compute mode unless absolutely necessary.
- ›Ensure that any data processed by aggregation pipelines comes from trusted sources or is properly validated.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.