External risk intelligence

MongoDB Compute Mode Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-13072

The vulnerability requires a non-default, explicitly enabled 'compute mode' on a standalone mongod instance. Databases are typically deployed within internal, isolated networks, and the requirement for a specific, manual configuration makes public internet exposure unlikely in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical memory corruption vulnerability in certain database instances when a specific, non-default compute mode is enabled. While this configuration requires explicit enablement, the underlying issue could lead to process termination or other unintended behaviors if exploited. The main concern is confirming whether this specific, manually enabled configuration is in use within your environment.

Memory corruption flaw in specialized database mode.
Understand its potential for disruption if enabled.
Confirm if this specific, non-default configuration is active.

Attack Path

How an attacker could exploit the issue

An attacker could potentially cause a standalone MongoDB instance to crash or behave unexpectedly if compute mode is enabled. This mode is not active by default and must be specifically configured. If an attacker can send specially crafted BSON data to the instance, it could lead to memory corruption during data processing.

Requires compute mode to be enabled.
Triggered by externally sourced BSON data.
Risk of denial-of-service or memory corruption.

Live Threat

Current exploitation, exposure, and threat context

When compute mode is enabled on a standalone `mongod` instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can lead to memory corruption. This could result in process termination or other unintended behaviors, but only when the non-default compute mode is explicitly enabled.

Database process termination.
Memory corruption via crafted BSON data.
Service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects standalone `mongod` instances with compute mode enabled. Application owners or the platform team responsible for the MongoDB deployment should identify all instances where compute mode is explicitly enabled. Confirming whether these specific instances are externally reachable and business-critical is the immediate first step before planning remediation, which may involve coordination with the MongoDB vendor.

Application or Platform owners are responsible.
Verify explicit compute mode enablement and exposure.
Plan vendor-coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is a standalone mongod instance?

A mongod instance is the core process that runs a MongoDB database. A 'standalone' deployment refers to a single database server running independently, rather than as part of a replica set or sharded cluster. These instances are used to store and manage application data, often serving as the primary repository for information in specialized or smaller-scale environments.

How does CVE-2026-13072 cause memory corruption?

This vulnerability relates to CWE-122, a heap-based buffer overflow. It occurs because the database does not properly validate BSON data—the binary format MongoDB uses for documents—when processed through an aggregation pipeline. When compute mode is active, handling specially crafted input can cause the system to write data outside of its intended memory boundaries, potentially crashing the process or causing unexpected behavior.

Do I need to worry if I am not using compute mode?

No. The vulnerability only affects mongod instances where 'compute mode' has been explicitly enabled at startup. Because this is a non-default, specialized configuration, standard MongoDB installations are not impacted. If you have not manually configured this specific mode, the flaw cannot be triggered by the described BSON data processing.

Is my database at risk from the internet?

According to Halo Surface Signal, this is unlikely. While the vulnerability allows for network-based interaction, databases are typically housed within isolated, internal networks. The requirement for a rare, manual configuration further reduces the probability of public exposure. You should focus your investigation on instances with compute mode enabled that might have broader network access.

When should I take action for this vulnerability?

Your first step is to audit your environment to identify any standalone mongod instances where compute mode is currently enabled. Once identified, evaluate whether these instances are necessary for business operations and if they have external connectivity. If you find systems meeting these criteria, consult with your database administrators and coordinate with your vendor to plan updates or configuration changes.

References

jira.mongodb.org/browse/SERVER-128494

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.