CVE-2026-13072 json
MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
published 3mo ago modified 16d ago also BIT-mongodb-2026-13072 , EUVD-2026-47789
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
Patch / fix
- bitnami mongodb 7.0.39, 8.0.28, 8.2.12, 8.3.7
- MongoDB MongoDB Server 7.0.39, 8.0.28, 8.2.12, 8.3.7
Is CVE-2026-13072 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 3mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=7.0.0, <7.0.39 >=8.0.0, <8.0.28 >=8.2.0, <8.2.12 >=8.3.0, <8.3.7 |
7.0.39 8.0.28 8.2.12 8.3.7 |
Affected products
- MongoDB MongoDB Server
Classification
- Weakness
-
- CWE-122 Heap-based Buffer Overflow
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-128494
vendor-advisory, patch, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-13072
web
Sources
- CVE List CVE-2026-13072
- NVD CVE-2026-13072
- OSV BIT-mongodb-2026-13072
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.