PT-2026-63459 · Mongodb · Mongodb Server

CVE-2026-13055 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The $ internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-13055

Affected Products

Mongodb Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-13055 · Security Note
• https://jira.mongodb.org/browse/SERVER-123081 · Note