CVE-2026-25613
📋 TL;DR
An authenticated MongoDB user can crash the database server by executing a query that targets a collection with an invalid compound wildcard index. This affects MongoDB deployments where users have query permissions and collections contain malformed compound wildcard indexes.
💻 Affected Systems
- MongoDB
📦 What is this software?
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
⚠️ Risk & Real-World Impact
Worst Case
Complete MongoDB server crash leading to denial of service, data unavailability, and potential data corruption if crashes occur during write operations.
Likely Case
Temporary service disruption as the MongoDB server crashes and requires restart, causing application downtime until recovery.
If Mitigated
Minimal impact with proper access controls limiting query permissions and monitoring for suspicious queries.
🎯 Exploit Status
Exploitation requires knowledge of collections with invalid compound wildcard indexes and user authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check MongoDB security advisory for specific patched versions
Vendor Advisory: https://jira.mongodb.org/browse/SERVER-113685
Restart Required: Yes
Instructions:
1. Check MongoDB version with 'mongod --version'. 2. Update to latest patched version via MongoDB's official update channels. 3. Restart MongoDB service after update.
🔧 Temporary Workarounds
Remove invalid compound wildcard indexes
allIdentify and drop any invalid compound wildcard indexes from collections
db.collection.getIndexes()
db.collection.dropIndex('index_name')
Restrict query permissions
allImplement principle of least privilege by limiting query permissions to trusted users only
db.revokeRolesFromUser('username', ['readWrite'])
db.grantRolesToUser('username', ['read'])
db.createRole({role: 'restricted', privileges: [], roles: []})
🧯 If You Can't Patch
- Implement strict access controls to limit which users can execute queries
- Monitor for and remove any invalid compound wildcard indexes from collections
🔍 How to Verify
Check if Vulnerable:
Check if MongoDB version is affected and if collections contain compound wildcard indexes: db.collection.getIndexes()Check Version:
mongod --versionVerify Fix Applied:
Verify MongoDB version is updated to patched version and test query execution against collections with compound wildcard indexes📡 Detection & Monitoring
Log Indicators:
- MongoDB crash logs
- Unexpected server termination messages
- Query errors related to wildcard indexes
Network Indicators:
- Sudden drop in MongoDB connections
- Application errors indicating database unavailability
SIEM Query:
source="mongodb.log" AND ("assertion" OR "Fatal" OR "terminating")