CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read

highCVSS 7.7CVE-2026-13078

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.7
Published: 2026-07-22
Last updated: 2026-07-23
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13078

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-130780.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-13078	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownMongoDB Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in MongoDB (July 24, 2026)cert-fr-avis
high[NEW] [high] MongoDB: Multiple vulnerabilitiescert-bund

Recent advisories for MongoDB Server where

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highGHSA-ppr4-5f46-j9c6: Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCerti…ghsa · 2026-07-24
mediumCVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by se…nvd · 2026-07-22
mediumCVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processin…nvd · 2026-07-22
mediumCVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a Mon…nvd · 2026-07-22
mediumCVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side Java…nvd · 2026-07-22
mediumCVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash…nvd · 2026-07-22