Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...

CVE-2026-13057

CVE-2026-13057 affects the server’s Atlas Search integration (MongoDB) in sharded topologies. An authenticated client can bypass per-user access controls by supplying internal routing fields for the $search and $searchMeta aggregation stages, which are normally populated only by the trusted route...