CVE-2026-13078
Medium
Description
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
SeverityMedium
CVSS6.3
Exploit probability32. percentile0.4%
Product
Mongodb
PublishedJul 22, 2026
First seenJul 22, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- mongodb mongodb7.0.39, 8.0.28, 8.2.12, 8.3.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb mongodb | 7.0.0 ≤ v < 7.0.39, 8.0.0 ≤ v < 8.0.28, 8.2.0 ≤ v < 8.2.12, 8.3.0 ≤ v < 8.3.7 | 7.0.39, 8.0.28, 8.2.12, 8.3.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.