BIT-mongodb-2026-13055

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/mongodb/BIT-mongodb-2026-13055.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-mongodb-2026-13055
Aliases
Published
2026-08-17T05:49:18.488Z
Modified
2026-08-17T08:01:41.121544568Z
Summary
Server crash via aggregation pipeline expression with compound wildcard index specification
Details

The $_internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

Database specific 
{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*"
    ]
}
References

Affected packages

Bitnami / mongodb

Package

Name
mongodb
Purl
pkg:bitnami/mongodb

Severity

  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
7.0.0
Fixed
7.0.39
Introduced
8.0.0
Fixed
8.0.28
Introduced
8.2.0
Fixed
8.2.12
Introduced
8.3.0
Fixed
8.3.7

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/mongodb/BIT-mongodb-2026-13055.json"