CVE-2026-13055: Server crash via aggregation pipeline expression with compound wildcard index specification
The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13055?
The severity of CVE-2026-13055 is rated as medium with a score of 6.5.
How do I fix CVE-2026-13055?
To fix CVE-2026-13055, ensure your MongoDB server is updated to the latest version that addresses this vulnerability.
What vulnerability does CVE-2026-13055 describe?
CVE-2026-13055 describes a vulnerability causing a server crash when using the $_internalIndexKey aggregation expression with specific index specifications.
Who is affected by CVE-2026-13055?
Any authenticated user with the ability to run aggregation commands is affected by CVE-2026-13055.
What impact does CVE-2026-13055 have on MongoDB?
CVE-2026-13055 can lead to a crash of the MongoDB (mongod) server, disrupting service availability.