CVE-2026-13057

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls.

In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-130586.5An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction comm CVE-2026-130598.1An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level a CVE-2026-13069.8The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'e CVE-2026-130606.5An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to CVE-2026-130614.3An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stag CVE-2026-130626.5An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata CVE-2026-130636.5An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sen CVE-2026-130646.5Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB dep CVE-2026-130656.5A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sor CVE-2026-130666.5Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process m CVE-2026-130676.3When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the CVE-2026-130684.3An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a se