CVE-2026-13072

EUVD-2026-47789
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mongodbmongodb
7.0 ≤
𝑥
< 7.0.39
CNA
mongodbmongodb
8.0 ≤
𝑥
< 8.0.28
CNA
mongodbmongodb
8.2.0 ≤
𝑥
< 8.2.12
CNA
mongodbmongodb
8.3.0 ≤
𝑥
< 8.3.7
CNA
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/SERVER-128494