What is CVE-2026-13066?

CVE-2026-13066 is a medium-severity vulnerability in Mongodb Server, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 6.5/10. Published 2026-07-22.

How severe is CVE-2026-13066?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Mongodb Server

CVE-2026-13066

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended inform…

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Mongodb Server — versions 7.0, 8.0, 8.2.0

Weakness classification (CWE)

CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-13066?: CVE-2026-13066 is a medium-severity vulnerability in Mongodb Server, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 6.5/10. Published 2026-07-22.
How severe is CVE-2026-13066?: Medium severity. CVSS v3 base score is 6.5 out of 10.