CVE-2025-13643

A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/SERVER-103582	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:mongodb:::::-:::*
	cpe:2.3:a:mongodb:mongodb:::::-:::*
	cpe:2.3:a:mongodb:mongodb:8.2.0:alpha:::-:::*
	cpe:2.3:a:mongodb:mongodb:8.2.0:alpha0:::-:::*
	cpe:2.3:a:mongodb:mongodb:8.2.0:alpha1:::-:::*
	cpe:2.3:a:mongodb:mongodb:8.2.0:alpha2:::-:::*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Un usuario con acceso al clúster con un conjunto limitado de acciones de privilegio podría ser capaz de terminar consultas que están siendo ejecutadas por otros usuarios. Esto podría causar una denegación de servicio al impedir que una fracción de las consultas se complete con éxito. Este problema afecta a MongoDB Server v7.0 versiones anteriores a 7.0.26 y a MongoDB Server v8.0 versiones anteriores a 8.0.14.

Information

Published : 2025-11-25 06:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-13643

Mitre link : CVE-2025-13643

CVE.ORG link : CVE-2025-13643

JSON object : View

Products Affected

mongodb

mongodb

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-13643", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13643", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-25T16:41:12.652084Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB Inc.", "product": "MongoDB Server", "versions": [{"status": "affected", "version": "8.0", "lessThan": "8.0.14", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.26", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-25T06:15:45.580", "references": [{"url": "https://jira.mongodb.org/browse/SERVER-103582", "tags": ["Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14"}, {"lang": "es", "value": "Un usuario con acceso al cl\u00faster con un conjunto limitado de acciones de privilegio podr\u00eda ser capaz de terminar consultas que est\u00e1n siendo ejecutadas por otros usuarios. Esto podr\u00eda causar una denegaci\u00f3n de servicio al impedir que una fracci\u00f3n de las consultas se complete con \u00e9xito. Este problema afecta a MongoDB Server v7.0 versiones anteriores a 7.0.26 y a MongoDB Server v8.0 versiones anteriores a 8.0.14."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "8788DEE3-96FD-4F62-BE22-EB3F9C4DD73F", "versionEndExcluding": "7.0.26", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "DB40CA6D-51A5-4D61-979F-E71C50C96B65", "versionEndExcluding": "8.0.14", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.2.0:alpha:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "5BF4D317-BC85-4BA9-9D64-91F14C4398F2"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.2.0:alpha0:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "64806572-E654-4691-90A6-C978BAD30263"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.2.0:alpha1:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "870C35A8-B7C5-4CC0-A8D6-D39DE370EEA9"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.2.0:alpha2:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "FCFCFC59-331F-47E1-9EA4-A0CA3D9F7989"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}