# CVE-2026-13055: Server crash via aggregation pipeline expression with compound wildcard index specification

> CVE-2026-13055: Server crash via aggregation pipeline expression with compound wildcard index specification. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-13055
Last updated: 2026-10-24T13:10:00Z

- Published: 2026-07-22 19:22 UTC · Updated: 2026-10-24 13:10 UTC · Assigner: mongodb
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.40%, 34th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-617

## Description

The \`$\_internalIndexKey\` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-13055)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13055)
- [https://jira.mongodb.org/browse/SERVER-123081](https://jira.mongodb.org/browse/SERVER-123081)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-13055 · Markdown: https://rewindex.com/cve/CVE-2026-13055.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-13055 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:11.366Z