The vulnerability CVE-2026-13055 in MongoDB Server arises from the `$_internalIndexKey` aggregation expression failing to correctly handle compound wildcard index specifications. When an authenticated user runs an aggregation pipeline using this expression, it triggers an internal consistency check that causes the server process (mongod) to abort. This is classified as a reachable assertion (CWE-617) vulnerability, leading to a denial of service condition by crashing the server. The vulnerability requires authenticated access and the ability to run aggregation pipelines.

An authenticated user with permission to run aggregation pipelines can exploit this vulnerability to crash the MongoDB server process, resulting in a denial of service. There is no indication of privilege escalation, data corruption, or data disclosure from the provided information. The impact is limited to service availability disruption.

No official patch or remediation level is currently provided for this vulnerability. Patch status is not yet confirmed — check the MongoDB vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent unauthorized use of aggregation pipelines if possible.