CVE-2026-13062 in Server
Summary
by MITRE • 07/22/2026
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical privilege escalation and data integrity issue within MongoDB's Queryable Encryption feature, specifically affecting sharded clusters with mongos routers. The flaw exists in the validation mechanisms that control access to internal encryption metadata fields, allowing authenticated users with write permissions on queryable encryption collections to manipulate server-controlled metadata through carefully crafted write operations. The vulnerability stems from insufficient access controls that fail to properly distinguish between user-accessible document fields and internally managed encryption metadata components.
The technical implementation of this vulnerability exploits the distributed nature of sharded MongoDB clusters where mongos routers act as intermediaries between clients and shard servers. When a user with write privileges submits a write command through mongos, the system should enforce strict boundaries between user-modifiable content and internal encryption metadata fields that govern how encrypted data is processed for query operations. However, the flaw allows attackers to inject or modify these metadata fields directly, potentially corrupting the encryption state that maintains query correctness for encrypted collections.
From an operational impact perspective, this vulnerability fundamentally undermines the security model of MongoDB's Queryable Encryption by enabling data corruption that affects the integrity of encrypted query operations. The corruption can manifest as false positive or negative results during encrypted queries, potentially leading to unauthorized data access or complete denial of service for encrypted collection operations. Attackers could leverage this to bypass encryption controls or manipulate search results in ways that compromise the confidentiality and integrity guarantees provided by the encryption mechanism.
The vulnerability aligns with CWE-284 (Improper Access Control) and CWE-352 (Cross-Site Request Forgery) categories, representing a failure in access control enforcement within MongoDB's distributed architecture. It also maps to ATT&CK techniques including T1078 (Valid Accounts) for privilege escalation and T1566 (Phishing) for initial access, though the core issue is an internal access control failure rather than external exploitation. Organizations using MongoDB with sharded clusters and queryable encryption should immediately implement mitigations including strict role-based access controls, monitoring of write operations on encrypted collections, and patch management to address the underlying access control implementation.
Security best practices recommend implementing comprehensive audit logging for all write operations on encrypted collections, particularly those involving mongos routers in sharded environments. The vulnerability demonstrates the critical importance of maintaining strict separation between user-accessible data and internal system metadata, especially in distributed database systems where intermediary components like mongos routers may introduce additional attack vectors. Organizations should also consider implementing network segmentation and additional monitoring controls to detect anomalous write patterns that might indicate exploitation attempts against this class of vulnerability.