CVE-2026-13078
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
Risk Assessment
An attacker could gain access to confidential data stored on the server, such as configuration files, credentials, or other sensitive system resources.
Recommendation
It is recommended to immediately update MongoDB Server to a patched version and restrict the mongod process privileges to the minimum necessary.
Other vulnerabilities in MongoDB Server
See all- CVE-2026-8336High
CVE-2026-8336 allows an authenticated user to crash the mongod server by improperly using server-side JavaScript functions. The issue affects MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
- CVE-2026-8053High
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog.
- CVE-2026-18712High
MongoDB Server has an issue in Queryable Encryption maintenance operations that could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.
- CVE-2026-18711High
MongoDB Server has an issue in the query execution engine that could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.
- CVE-2026-18709Medium
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
- CVE-2026-18708Medium
A vulnerability in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to execute controlled code within the query scope of other users via a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.
- CVE-2026-18707Medium
A vulnerability in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.
- CVE-2026-18706Medium
A vulnerability in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.
- CVE-2026-18705Medium
A vulnerability in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.
- CVE-2026-18704Medium
A vulnerability in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.
Original NVD description (English source)
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.