CVE-2026-25613: 
MongoDB vulnerability analysis and mitigation

CVE-2026-25613 is a denial-of-service vulnerability in MongoDB that allows an authenticated user with low privileges to crash the MongoDB server by issuing a query against a collection containing an invalid compound wildcard index. It was published on February 10, 2026, and affects MongoDB versions 7.0.0–7.0.28, 8.0.0–8.0.17, and 8.2.0–8.2.3. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (MongoDB Jira, Red Hat Advisory).

The root cause is classified as CWE-704 (Incorrect Type Conversion or Cast), where MongoDB improperly handles queries targeting collections with malformed compound wildcard indexes, leading to a server crash. An authenticated attacker with network access and low-privilege credentials can trigger the fault by querying such a collection, requiring no user interaction and no elevated permissions. The attack vector is network-based with low complexity, making it straightforward to execute for any authorized database user (MongoDB Jira, Red Hat Advisory).

Successful exploitation results in a complete denial of service — the MongoDB server process crashes, disrupting availability for all dependent applications and services. There is no confidentiality or integrity impact, as the vulnerability solely affects availability. In environments where MongoDB serves as a critical backend, a crash can cause cascading failures across dependent services until the server is manually restarted (MongoDB Jira).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A patch has been available since February 2026 (Red Hat Advisory, MongoDB Jira).

1. Reconnaissance: Identify MongoDB instances running affected versions (7.0.0–7.0.28, 8.0.0–8.0.17, or 8.2.0–8.2.3) accessible over the network using tools like Shodan or direct network scanning.
2. Authentication: Obtain or use existing low-privilege credentials to authenticate to the target MongoDB server.
3. Identify target collection: Locate or create a collection that contains an invalid compound wildcard index — this may already exist in misconfigured deployments.
4. Issue malicious query: Execute a query against the identified collection with the malformed compound wildcard index, triggering the incorrect type conversion internally.
5. Server crash: MongoDB processes the query, encounters the type conversion fault, and crashes, resulting in a denial of service for all connected clients (MongoDB Jira).

• Logs: Unexpected MongoDB server crash entries or fatal assertion errors in mongod.log correlated with queries against collections using compound wildcard indexes.
• Process: Sudden termination of the mongod process without a graceful shutdown signal; repeated restarts of the MongoDB service in a short timeframe.
• Network: Authenticated connections from unusual or unexpected source IPs issuing queries to collections with compound wildcard indexes immediately before server crashes.

MongoDB has released patched versions addressing this vulnerability: upgrade to 7.0.29 or later for 7.0.x deployments, 8.0.18 or later for 8.0.x deployments, and 8.2.4 or later for 8.2.x deployments. As interim mitigations, restrict database access to only trusted and necessary users, implement network segmentation to limit exposure of MongoDB ports, and monitor for suspicious query patterns targeting compound wildcard indexes. Upgrading to a patched version is the recommended and definitive remediation (MongoDB Jira, Red Hat Advisory).