CVE-2026-13078: 
MongoDB 脆弱性の分析と軽減

CVE-2026-13078 is a file disclosure vulnerability in MongoDB Server caused by the server-side MozJS (SpiderMonkey) scripting engine unconditionally registering a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user can exploit this through crafted aggregation pipeline commands to access sensitive files on the server host. The vulnerability was published on July 22, 2026, and affects MongoDB Server versions 7.0 before 7.0.39, 8.0 before 8.0.28, 8.2.0 before 8.2.12, and 8.3.0 before 8.3.7. It carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, MongoDB Jira).

The root cause is classified as CWE-862 (Missing Authorization): the MozJS scripting engine registers a module loading hook without enforcing proper authorization checks, allowing JavaScript executed within the MongoDB aggregation pipeline to invoke file-reading operations outside the intended database scope (GitHub Advisory). An attacker exploits this by submitting crafted aggregation pipeline commands — specifically leveraging the $function or similar JavaScript-enabled aggregation operators — that invoke the module loading hook to read arbitrary files accessible to the mongod process. The attack vector is network-based, requires low privileges (authenticated database user), no user interaction, and no special attack complexity, making it straightforward to execute once credentials are obtained (GitHub Advisory). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an authenticated attacker to read arbitrary files from the host filesystem with the privileges of the mongod process, potentially exposing sensitive data such as configuration files, private keys, credentials, /etc/passwd, application secrets, or other files accessible to the MongoDB service account (GitHub Advisory). The impact is limited to confidentiality — there is no integrity or availability impact on the vulnerable system itself, though the subsequent system confidentiality impact is rated High due to the potential for sensitive host-level file disclosure (GitHub Advisory). Exposed credentials or configuration data could facilitate lateral movement or privilege escalation within the broader environment.

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time (GitHub Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.34% (0.0034), placing it in the 11th percentile for exploitation probability within the next 30 days (GitHub Advisory). No threat actor attribution has been reported. The NVD SSVC assessment also indicates no known exploitation and the attack is not automatable.

1. Reconnaissance: Identify MongoDB Server instances running affected versions (7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7) using network scanning tools such as Shodan, Censys, or nmap targeting default MongoDB port 27017.
2. Obtain credentials: Acquire valid MongoDB user credentials with at least low-privilege database access (e.g., through credential stuffing, phishing, or reuse of leaked credentials).
3. Connect to MongoDB: Authenticate to the target MongoDB instance using a MongoDB client (e.g., mongosh, PyMongo, or the MongoDB shell) with the obtained credentials.
4. Craft malicious aggregation pipeline: Construct an aggregation pipeline command that leverages the MozJS module loading hook to invoke JavaScript file-reading functionality. For example, use a $function stage or similar JavaScript-enabled operator that calls the registered module hook to load a target file path (e.g., /etc/passwd, /etc/mongod.conf, or application credential files).
5. Exfiltrate file contents: Execute the crafted pipeline against a database collection and retrieve the file contents returned in the query results, using the mongod process's filesystem privileges.
6. Leverage disclosed data: Use any exposed credentials, private keys, or configuration data to escalate privileges or move laterally within the environment (GitHub Advisory, MongoDB Jira).

• Network: Unusual or unexpected authenticated connections to MongoDB (port 27017/TCP) from unfamiliar source IPs or at atypical hours; high-frequency aggregation pipeline queries from a single client.
• Logs: MongoDB diagnostic logs (mongod.log) showing aggregation pipeline commands containing JavaScript ($function, $where, or similar operators) with file path strings (e.g., /etc/, /home/, /var/, .conf, .key, .pem); repeated pipeline execution errors related to module loading.
• Process: Unexpected file access by the mongod process to sensitive system files outside the MongoDB data directory, observable via auditd, inotifywait, or similar file access monitoring tools on Linux.
• File System: No direct file artifacts expected from exploitation, but review MongoDB audit logs for access to sensitive paths if MongoDB auditing is enabled.

MongoDB has released patched versions addressing this vulnerability: 7.0.39, 8.0.28, 8.2.12, and 8.3.7 — upgrading to one of these versions is the primary recommended remediation (GitHub Advisory, MongoDB Jira). As interim mitigations, restrict database access to trusted and necessary users only, enforce the principle of least privilege for MongoDB accounts, and disable JavaScript execution in MongoDB if not required (using --noscripting flag or security.javascriptEnabled: false in mongod.conf). Additionally, implement network segmentation to limit exposure of MongoDB instances, and monitor aggregation pipeline queries for suspicious file system access patterns.

Coverage of CVE-2026-13078 has been noted in security aggregation platforms and community feeds, including a Mastodon post from @thehackerwire and coverage by SecurityOnline.info and BeyondMachines.net in the context of MongoDB patching 26 vulnerabilities in the same release cycle (SecurityOnline, BeyondMachines). Tenable has published a detection plugin (Nessus plugin 329420) for this vulnerability. No significant vendor statements beyond the advisory or notable researcher commentary have been identified at this time.