CVE-2026-13057: Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META
An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls.
In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13057?
CVE-2026-13057 has a medium severity score of 5.3.
How do I fix CVE-2026-13057?
To fix CVE-2026-13057, ensure that proper per-user access controls are enforced in the query pipeline.
What type of vulnerability is CVE-2026-13057?
CVE-2026-13057 is an authorization bypass vulnerability due to improper input validation.
What software is affected by CVE-2026-13057?
CVE-2026-13057 affects MongoDB Atlas Search.
What impact does CVE-2026-13057 have?
CVE-2026-13057 allows authenticated users to access unauthorized collection data through specific aggregation queries.