CVE-2026-13078: MongoDB Server Information Disclosure Flaw

CVE-2026-13078 Overview

CVE-2026-13078 is an authorization flaw in MongoDB Server's server-side MozJS scripting engine. The engine unconditionally registered a module loading hook that exposed a JavaScript path allowing arbitrary file reads from the host filesystem. An authenticated user can craft aggregation pipeline commands that invoke this hook to read files accessible to the mongod process. The vulnerability is classified under [CWE-862] Missing Authorization and stems from the absence of access controls around the module loader. Exploitation reveals sensitive files owned or readable by the MongoDB service account, including configuration files, credentials, and key material stored on the same host.

Critical Impact
An authenticated MongoDB user can read arbitrary files from the host filesystem using the privileges of the mongod process through crafted aggregation pipeline commands.

Affected Products

MongoDB Server (versions with the MozJS scripting engine registering the module loading hook)
Deployments that permit server-side JavaScript execution in aggregation pipelines
MongoDB instances where authenticated users can submit aggregation commands

Discovery Timeline

2026-07-22 - CVE-2026-13078 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13078

Vulnerability Analysis

MongoDB Server embeds the MozJS engine to execute server-side JavaScript inside operators such as $where, $function, $accumulator, and mapReduce. The MozJS integration registers a module loading hook without gating it behind an authorization check. Once registered, JavaScript code executing inside the sandbox can invoke module loading semantics that reach the host filesystem. The loader reads files from paths supplied by the caller, returning their contents to the JavaScript context. Because MongoDB executes these operations under the mongod service identity, any file readable by that account becomes accessible to the attacker. This exposes on-disk WiredTiger data files, mongod.conf, keyfiles used for internal cluster authentication, TLS private keys, and adjacent secrets on the same host.

Root Cause

The defect is a missing authorization check ([CWE-862]) on a sensitive scripting primitive. The MozJS integration should either omit the module loading hook, restrict it to a sandboxed virtual filesystem, or require a privileged role before honoring load requests. Instead, the hook is registered unconditionally, so any user with permission to run aggregation pipelines that evaluate JavaScript inherits filesystem read capability from the server process.

Attack Vector

Exploitation requires network access to the MongoDB service and valid credentials for a role permitted to execute aggregation pipelines. The attacker submits an aggregation command containing a stage that evaluates JavaScript. Within that stage, the attacker triggers the module loading hook against an attacker-chosen absolute path. The engine returns file contents to the JavaScript execution context, which the attacker exfiltrates through the pipeline's output document. Because the flaw resides in server-side script evaluation, no local access to the database host is required and no user interaction beyond authentication is needed.

No verified public exploit code is available. See the MongoDB Jira Issue SERVER-128832 for vendor technical details.

Detection Methods for CVE-2026-13078

Indicators of Compromise

Aggregation pipeline commands referencing $where, $function, $accumulator, or mapReduce with unusually large or obfuscated JavaScript payloads.
Aggregation output documents containing filesystem paths or file contents such as /etc/, mongod.conf, or TLS key material.
Authenticated sessions from low-privilege accounts executing server-side JavaScript against collections they do not normally query.

Detection Strategies

Enable MongoDB audit logging for command and authCheck events and alert on JavaScript-bearing aggregation stages issued by non-administrative roles.
Correlate mongod process file read activity against JavaScript-evaluating aggregation commands to catch off-pattern access to sensitive paths.
Baseline normal aggregation traffic per application account and flag deviations that introduce $function or $accumulator stages.

Monitoring Recommendations

Ship MongoDB audit logs and host filesystem telemetry to a centralized log platform for correlation and retention.
Monitor mongod reads of files outside the database data directory, particularly configuration files, keyfiles, and private keys.
Track authentication attempts and role assignments for any account with permissions to run aggregation commands.

How to Mitigate CVE-2026-13078

Immediate Actions Required

Apply the MongoDB Server update that removes or gates the MozJS module loading hook as tracked in SERVER-128832.
Disable server-side scripting where it is not required by setting security.javascriptEnabled: false in mongod.conf.
Rotate keyfiles, TLS private keys, and any credentials stored on hosts running vulnerable mongod instances.
Audit MongoDB role assignments and remove aggregation or scripting privileges from accounts that do not need them.

Patch Information

Refer to the MongoDB tracking ticket SERVER-128832 for fixed version details. Upgrade all affected mongod nodes across replica sets and sharded clusters to a patched release. After patching, verify that the MozJS engine no longer honors filesystem module loads by reviewing release notes for the specific version deployed.

Workarounds

Set security.javascriptEnabled: false in mongod.conf to disable server-side JavaScript execution when the workload does not require it.
Restrict aggregation privileges through role-based access control so only vetted service accounts can submit pipelines containing $where, $function, $accumulator, or mapReduce.
Run mongod under a dedicated low-privilege user account whose filesystem access is limited to the data directory and required configuration files.
Segment MongoDB hosts on isolated networks and require authenticated, encrypted client connections to reduce the pool of users who can submit aggregation commands.

bash

# Configuration example: disable server-side JavaScript in mongod.conf
security:
  javascriptEnabled: false
  authorization: enabled
  keyFile: /etc/mongodb/keyfile