# CVE-2026-13057: Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

> CVE-2026-13057: Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META. CVSS 5.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-13057
Last updated: 2026-10-24T13:10:00Z

- Published: 2026-07-22 19:22 UTC · Updated: 2026-10-24 13:10 UTC · Assigner: mongodb
- CVSS: 5.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.35%, 28th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-20

## Description

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-13057)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13057)
- [https://jira.mongodb.org/browse/SERVER-126247](https://jira.mongodb.org/browse/SERVER-126247)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-13057 · Markdown: https://rewindex.com/cve/CVE-2026-13057.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-13057 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:49.107Z