Vulnerability · Published Jul 22, 2026 · Assigned by mongodb
CVE-2026-13078Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
High 7.7
In plain English
A high-severity missing authorization in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 7.0 – before 7.0.398.0 – before 8.0.288.2.0 – before 8.2.128.3.0 – before 8.3.7 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N