CVE-2026-13078 in MongoDB
Summary
by MITRE • 07/22/2026
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical server-side code execution flaw in MongoDB Server that stems from improper handling of the server-side JavaScript engine known as MozJS. The issue manifests when the mongod process registers a module loading hook without proper access controls, creating an unintended pathway for file system traversal and information disclosure. The vulnerability exists within the scripting engine's initialization process where it unconditionally establishes hooks that allow JavaScript code executed within MongoDB aggregation pipelines to perform file operations on the underlying host system. This design flaw enables authenticated users to leverage legitimate MongoDB operations to bypass normal file system permissions and access files that should otherwise be restricted to the database process. The vulnerability directly relates to CWE-20, which addresses improper input validation, and CWE-73, which covers hardcoded search paths, as the system fails to validate or restrict file access during script execution. From an operational perspective, this vulnerability allows attackers with valid MongoDB credentials to read arbitrary files from the host system, potentially exposing sensitive data such as configuration files, database credentials, application secrets, and other privileged information that exists within the mongod process's security context.
The exploitation mechanism relies on crafting specific aggregation pipeline commands that trigger the vulnerable MozJS module loading hook. When an authenticated user submits a malicious pipeline operation, the server-side JavaScript engine processes these commands and inadvertently executes file reading operations using the elevated privileges of the mongod process. This creates a privilege escalation scenario where user-level database access translates to system-level file access, effectively bypassing traditional operating system security boundaries. The vulnerability is particularly concerning because it operates within the legitimate MongoDB processing pipeline, making detection more difficult and allowing attackers to remain undetected while performing reconnaissance and data extraction activities. Attackers can leverage this capability to discover sensitive information such as SSL certificates, database connection strings, application configuration files, and other system-level artifacts that may contain additional attack vectors or credentials.
The impact of this vulnerability extends beyond simple information disclosure to potentially enable further compromise of the underlying infrastructure. An attacker who successfully exploits this vulnerability could gain access to database backup files, encryption keys, or other sensitive resources that might reveal additional security weaknesses within the organization's infrastructure. This type of vulnerability aligns with ATT&CK technique T1078 which covers valid accounts and T1566 which covers malicious file execution, as it leverages legitimate authentication mechanisms to perform unauthorized file system operations. Organizations running MongoDB servers without proper patching or mitigation measures face significant risk of data breaches, regulatory compliance violations, and potential system compromise. The vulnerability also demonstrates poor principle of least privilege implementation where the database process operates with unnecessary file system access rights that could be restricted through proper configuration.
Mitigation strategies should focus on immediate patching of affected MongoDB versions to address the specific MozJS module loading hook implementation. Organizations must ensure that all MongoDB deployments are updated to patched versions that properly validate and restrict file system access within the JavaScript execution environment. Network segmentation and firewall rules should limit direct database access to trusted administrative networks, while implementing strict authentication controls and monitoring for unusual aggregation pipeline operations. Database users should be granted minimal required privileges through proper role-based access control implementations, and all MongoDB instances should run with reduced file system permissions where possible. Additionally, organizations should implement comprehensive monitoring of MongoDB aggregation pipeline activity, particularly focusing on operations that might indicate exploitation attempts such as suspicious file path references or unusual data extraction patterns. Regular security assessments and penetration testing should include evaluation of server-side script execution capabilities to identify similar vulnerabilities in other database systems or application frameworks that may exhibit similar design flaws.