CVE-2026-13066
Full vulnerability record from the local CVENow database.
Description
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-22 20:16:44.813000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-13066",
"sourceIdentifier": "[email protected]",
"published": "2026-07-22T20:16:44.813",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript."
},
{
"lang": "es",
"value": "Manejo inadecuado de objetos DBPointer durante la serialización BSON en el motor JavaScript del servidor de MongoDB puede resultar en que los contenidos de la memoria interna del proceso sean incluidos en los datos devueltos al cliente. Esto constituye una revelación de información no intencionada que afecta a las implementaciones que utilizan JavaScript del lado del servidor."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "MongoDB",
"product": "MongoDB Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.0",
"lessThan": "7.0.39",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.0",
"lessThan": "8.0.28",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.2.0",
"lessThan": "8.2.12",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.3.0",
"lessThan": "8.3.7",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-23T14:23:03.449071Z",
"id": "CVE-2026-13066",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-843"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.0.39",
"matchCriteriaId": "53A9D948-1D2E-4944-A927-355B050FE628"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*",
"versionStartIncluding": "8.0.0",
"versionEndExcluding": "8.0.28",
"matchCriteriaId": "77C7B2B9-8744-4DE9-9A6E-9E00779F747A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*",
"versionStartIncluding": "8.2.0",
"versionEndExcluding": "8.2.12",
"matchCriteriaId": "E22F06D2-19F4-4869-BA89-CF181A37F1FB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*",
"versionStartIncluding": "8.3.0",
"versionEndExcluding": "8.3.7",
"matchCriteriaId": "08ECFF67-5CF6-475F-9E4C-34E5F0DE114E"
}
]
}
]
}
],
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-127694",
"source": "[email protected]",
"tags": [
"Vendor Advisory",
"Issue Tracking"
]
}
]
}