Listen to this Post
How CVE-2026-13060 Works
CVE-2026-13060 is an authorization bypass vulnerability affecting MongoDB Server, specifically within the aggregation framework’s `$graphLookup` stage. The flaw arises from an inconsistency between how MongoDB performs authorization checks during the parsing/planning phase versus the actual execution phase of an aggregation query.
In a properly secured MongoDB deployment, role-based access control (RBAC) restricts authenticated users to only the collections and documents they have explicit read permissions for. However, when a view is created with a pipeline that includes a `$graphLookup` stage referencing other collections, the authorization logic fails to consistently enforce these boundaries.
During the authorization evaluation phase, MongoDB assesses whether the user has the necessary privileges to execute the aggregation on the view. This initial check may only verify permissions against the view itself, not recursively against every collection referenced inside the `$graphLookup` operator. The system may incorrectly assume that because the user can read the view, they are also authorized to access all collections the view’s pipeline touches.
During execution, however, the `$graphLookup` stage performs recursive graph traversals across collections. If the authorization checks performed earlier did not properly validate access to these referenced collections, the execution engine proceeds to retrieve documents from them without reevaluating the user’s actual privileges. This creates a window where an authenticated attacker with limited read rights on one collection can craft an aggregation query that traverses into restricted collections via a view that contains a `$graphLookup` pipeline.
The attack requires network access, low privileges, and low complexity. The affected scenarios specifically involve collections referenced within existing view pipeline definitions. No public proof-of-concept or active exploitation evidence has been reported. The vulnerability is rooted in CWE-863 (Incorrect Authorization) and is tracked under MongoDB Jira issue SERVER-127357.
DailyCVE Form:
Platform: MongoDB Server
Version: <7.0.39, <8.0.28, <8.2.12, <8.3.7
Vulnerability: Authorization bypass ($graphLookup)
Severity: Medium (CVSS 3.1: 6.5)
date: 2026-07-22
Prediction: 2026-08-05
What Undercode Say: Analytics
The following MongoDB shell commands and queries can be used to audit for potentially vulnerable view definitions and to test whether a `$graphLookup` pipeline can access unauthorized collections.
List all views with $graphLookup stages:
// Connect to MongoDB and switch to the target database
use admin
// Find all views that contain $graphLookup in their pipeline definitions
db.getCollectionInfos({ type: "view" }).forEach(function(view) {
var pipeline = view.options.pipeline;
var hasGraphLookup = false;
pipeline.forEach(function(stage) {
if (stage.hasOwnProperty("$graphLookup")) {
hasGraphLookup = true;
}
});
if (hasGraphLookup) {
print("View: " + view.name + " contains $graphLookup");
printjson(pipeline);
}
});
Test authorization bypass attempt:
// As a low-privilege user, attempt to run a $graphLookup on a view
// that references a restricted collection (e.g., "restrictedData")
db.trustedView.aggregate([
{
$graphLookup: {
from: "restrictedData",
startWith: "$field",
connectFromField: "field",
connectToField: "field",
as: "unauthorizedData"
}
}
]).toArray();
// If documents from "restrictedData" are returned despite lacking read
// permissions, the system is vulnerable.
Check current MongoDB version:
// Run in mongo shell db.version();
Recommended patch versions:
Upgrade to patched versions: MongoDB 7.0.39 or later MongoDB 8.0.28 or later MongoDB 8.2.12 or later MongoDB 8.3.7 or later
Audit view pipelines using aggregation:
// Identify views with cross-collection $graphLookup references
db.getCollectionInfos({ type: "view" }).forEach(function(v) {
var pipe = v.options.pipeline || [];
pipe.forEach(function(s) {
if (s.$graphLookup && s.$graphLookup.from) {
print("WARNING: View '" + v.name + "' references collection '" +
s.$graphLookup.from + "' via $graphLookup.");
}
});
});
How Exploit:
An attacker with minimal read privileges on at least one collection or view can exploit this vulnerability by:
1. Identifying or creating a view that includes a `$graphLookup` stage referencing a restricted collection.
2. Executing an aggregation query against that view with a crafted `$graphLookup` pipeline.
3. The authorization check during query planning incorrectly permits the operation based on view-level permissions.
4. During execution, the `$graphLookup` stage recursively traverses into the referenced restricted collection and returns documents without rechecking the user’s actual read permissions.
The attack is remotely exploitable over the network, requires no user interaction, and has low attack complexity. The impact is limited to confidentiality (unauthorized read access) with no effect on integrity or availability.
Protection from this CVE:
- Immediate: Upgrade MongoDB Server to the patched versions: 7.0.39+, 8.0.28+, 8.2.12+, or 8.3.7+.
- Workaround: Restrict execution of aggregation queries containing `$graphLookup` to only highly trusted users until patching is complete.
- Audit: Review all existing view pipeline definitions for `$graphLookup` stages that reference collections outside the view’s own namespace.
- Monitoring: Implement database activity monitoring for unusual aggregation patterns, especially `$graphLookup` operations targeting multiple collections.
- Least Privilege: Conduct privilege reviews to ensure users only have read access to collections required for legitimate business purposes.
Impact:
- Confidentiality: High – An authenticated user with limited read privileges can exfiltrate sensitive documents from collections they should not be authorized to access. This undermines MongoDB’s RBAC model and data partitioning.
- Integrity: None – The vulnerability does not allow modification, deletion, or creation of data.
- Availability: None – No denial-of-service impact.
- CVSS 3.1 Score: 6.5 (Medium).
- CVSS 4.0 Score: 7.1 (High).
- EPSS: 0.42% (low likelihood of exploitation in the wild).
- Affected Deployments: Environments with complex view hierarchies, multi-collection references, and heavy use of `$graphLookup` in pipeline definitions.
- Business Risk: Serious for multi-tenant databases or environments where sensitive data is siloed across collections; a single low-privilege user could aggregate information from disparate data sources.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
