Description
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
Published: 2026-08-11
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper input validation in MongoDB Server's aggregation framework. An unauthenticated attacker can send a specifically crafted aggregation command that causes the mongos router process to crash. The crash leads to a denial of service, disrupting all client connections routed through the affected mongos instance.

Affected Systems

This issue affects MongoDB Server, particularly the mongos (router) component. Specific version numbers that are vulnerable are not listed in the advisory; users should review MongoDB release notes for the patch that addresses SERVER-130110.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity risk. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires sending the malformed aggregation command without authentication; it can be performed by anyone who can reach the mongos port. Successful exploitation terminates the mongos process but does not provide further access to data.

Generated by OpenCVE AI on August 12, 2026 at 19:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the newest MongoDB Server release that contains the fix for SERVER-130110.
  • If upgrading immediately is not feasible, restrict access to the mongos port to trusted networks or enforce authentication for clients connecting to the router.
  • Monitor mongos logs for unexpected restarts and aggregation command anomalies, and configure automated restarts or failover to maintain availability.

Generated by OpenCVE AI on August 12, 2026 at 19:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb mongodb Server
Vendors & Products Mongodb
Mongodb mongodb Server

Tue, 11 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
Title Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
Weaknesses CWE-617
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Mongodb Server
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-08-11T20:29:08.509Z

Reserved: 2026-08-03T15:53:33.908Z

Link: CVE-2026-18697

cve-icon Vulnrichment

Updated: 2026-08-11T20:29:04.605Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T19:17:23.983

Modified: 2026-08-28T21:16:15.740

Link: CVE-2026-18697

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T20:00:04Z

Weaknesses