PT-2026-63461 · Mongodb · Mongodb Server

CVE-2026-13057 · Publicado 2026-07-22 · Atualizado 2026-07-22

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls.

In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-13057

Produtos afetados

Mongodb Server

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-13057 · Nota de Segurança
• https://jira.mongodb.org/browse/SERVER-126247 · Nota