CVE-2026-13078: 
MongoDB Schwachstellenanalyse und -minderung

CVE-2026-13078 is a file disclosure vulnerability in MongoDB Server caused by the server-side MozJS (SpiderMonkey) scripting engine unconditionally registering a module loading hook that allows JavaScript to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user can exploit this through crafted aggregation pipeline commands to access sensitive files on the server. Affected versions include MongoDB Server 7.0 before 7.0.39, 8.0 before 8.0.28, 8.2.0 before 8.2.12, and 8.3.0 before 8.3.7. The vulnerability was published on July 22, 2026, and carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, MongoDB Jira).

The root cause is classified as CWE-862 (Missing Authorization): the MozJS scripting engine registers a module loading hook without enforcing proper authorization controls, enabling JavaScript code executed within MongoDB's server-side scripting context to invoke filesystem read operations beyond the intended scope (GitHub Advisory). An attacker with low-privileged authenticated access to the MongoDB instance can craft aggregation pipeline commands (e.g., using $function or similar JavaScript-enabled stages) that leverage this hook to read arbitrary files accessible to the mongod process. No special configuration is required beyond having a valid database credential, and the attack is conducted entirely over the network without user interaction (GitHub Advisory).

Successful exploitation allows an authenticated attacker to read arbitrary files from the host filesystem with the privileges of the mongod process, potentially exposing sensitive data such as configuration files, private keys, credentials, or other secrets stored on the server. There is no integrity or availability impact — the vulnerability is limited to confidentiality of the subsequent (host) system. In environments where MongoDB runs with elevated OS privileges, the scope of accessible files is significantly broader, increasing the risk of credential theft and lateral movement (GitHub Advisory, MongoDB Jira).

1. Reconnaissance: Identify MongoDB instances running affected versions (7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7) using network scanning tools such as Shodan, Censys, or nmap targeting port 27017.
2. Obtain credentials: Acquire low-privileged MongoDB credentials through phishing, credential stuffing, or other means — any authenticated user account is sufficient.
3. Connect to MongoDB: Use the mongo shell, mongosh, or a MongoDB driver to authenticate to the target instance.
4. Craft malicious aggregation pipeline: Construct an aggregation pipeline command that leverages the MozJS module loading hook within a JavaScript-enabled stage (e.g., $function or $where) to invoke a file read operation targeting a sensitive file (e.g., /etc/passwd, /etc/shadow, application configuration files, or TLS private keys).
5. Exfiltrate file contents: The JavaScript execution context reads the target file using the mongod process's OS privileges and returns the contents as part of the query result, which the attacker retrieves over the network (GitHub Advisory, MongoDB Jira).

• Network: Authenticated connections to MongoDB (port 27017) from unexpected or external IP addresses; unusual query volumes from a single authenticated user.
• Logs: MongoDB audit logs showing aggregation pipeline commands with JavaScript ($function, $where, or similar operators) executed by low-privileged users; repeated or unusual use of server-side scripting stages targeting file paths.
• Process: The mongod process accessing files outside its normal data directory (e.g., /etc/, /home/, application config directories) — detectable via auditd, strace, or eBPF-based monitoring tools.
• File System: No direct file system artifacts are expected from read-only exploitation, but access timestamps on sensitive files (e.g., /etc/passwd, private key files) may be updated unexpectedly.

MongoDB has released patched versions addressing this vulnerability: 7.0.39, 8.0.28, 8.2.12, and 8.3.7 (MongoDB Jira). Upgrading to a fixed version is the primary recommended remediation. As interim mitigations, administrators should restrict database access to trusted users only, disable server-side JavaScript execution if not required (--noscripting flag or security.javascriptEnabled: false in the configuration), implement network segmentation to limit MongoDB exposure, and run the mongod process with the minimum required OS privileges to reduce the impact of potential file disclosure (GitHub Advisory).

Coverage of CVE-2026-13078 has been limited to automated vulnerability tracking platforms and security news aggregators. Security Online Info published a summary of MongoDB vulnerabilities disclosed in 2026, and Beyond Machines noted that MongoDB patched 26 vulnerabilities in the same release cycle, including this file disclosure issue (Beyond Machines). No notable independent researcher commentary or significant social media discussion has been identified beyond automated CVE feed posts.