CVE-2026-13078: Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13078?
CVE-2026-13078 has a high severity rating of 7.7.
How do I fix CVE-2026-13078?
To mitigate CVE-2026-13078, update your MongoDB Server to the latest version where the vulnerability has been addressed.
Who can exploit CVE-2026-13078?
An authenticated user with access to the MongoDB Server can exploit CVE-2026-13078 to disclose local files.
What type of vulnerability is CVE-2026-13078?
CVE-2026-13078 is classified as a Local File Disclosure vulnerability.
What impact does CVE-2026-13078 have on MongoDB Server?
CVE-2026-13078 allows an authenticated user to read arbitrary files from the host filesystem, potentially exposing sensitive data.