CVE-2026-13068: MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse
An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13068?
The severity of CVE-2026-13068 is medium with a score of 4.2.
How do I fix CVE-2026-13068?
To fix CVE-2026-13068, ensure that cursor termination privileges are properly scoped to the respective database by applying the necessary updates or patches.
What impact does CVE-2026-13068 have on MongoDB users?
CVE-2026-13068 allows an authenticated user to disrupt ongoing query operations by incorrectly terminating active cursors on a different database.
Who is affected by CVE-2026-13068?
Any authenticated user with cursor termination privileges in MongoDB is at risk of exploiting CVE-2026-13068.
When was CVE-2026-13068 published?
CVE-2026-13068 was published on July 22, 2026.