CVE-2026-13057 describes a vulnerability in the Atlas Search integration of a server using sharded topologies. The $search and $searchMeta aggregation stages rely on internal routing information normally set by a trusted router during sharded search planning. However, insufficient input validation permits an authenticated user to directly supply these internal routing fields, enabling bypass of per-user access controls. This vulnerability is categorized under CWE-20 (Improper Input Validation). No patch or remediation details are provided in the available data.

An authenticated user can bypass per-user access controls in the Atlas Search integration on sharded topologies. This could allow unauthorized access to data or search results that should be restricted based on user permissions. The vulnerability does not appear to allow privilege escalation beyond authenticated user capabilities, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted authenticated users only and monitor for unusual usage patterns related to $search and $searchMeta aggregation stages. Avoid exposing these aggregation stages to untrusted users.