CVE-2026-13078 is a vulnerability in MongoDB Server where the MozJS scripting engine on the server side registers a module loading hook without restrictions. This flaw allows authenticated users to execute JavaScript calls that read arbitrary files from the host filesystem with the permissions of the MongoDB server process. Exploitation requires authentication and is performed through specially crafted aggregation pipeline commands.

An authenticated attacker can read sensitive files accessible to the MongoDB server process on the host filesystem. This could lead to unauthorized disclosure of sensitive data stored on the server. There is no indication of privilege escalation beyond the mongod process privileges or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to authenticated users and monitor for suspicious aggregation pipeline commands that could exploit this vulnerability.