CVE-2026-13055 — Server crash via aggregation pipeline expression with compound wildcard index specification
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index …
Published: 2026-07-22 · CVSS: 7.1 · CVSS 4.0
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7