Executive brief
A security vulnerability in MongoDB Server could allow an authorized user to read sensitive files from the underlying server's operating system. By using specific database commands, an attacker can bypass intended restrictions to access data they should not be able to see, potentially leading to the exposure of configuration files or system credentials. This issue affects organizations running specific versions of MongoDB where server-side scripting is enabled.
Technical details
A vulnerability exists in the MongoDB Server MozJS scripting engine due to the unconditional registration of a module loading hook. This flaw allows JavaScript execution environments within the database to invoke file-reading operations with the privileges of the 'mongod' process. An attacker with network access and basic authentication privileges can exploit this by submitting crafted aggregation pipeline commands. Successful exploitation results in unauthorized disclosure of arbitrary files from the host filesystem. Patches are available in versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc1.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-06-11: other: Issue reported internally/created in Jira
- 2026-07-22: disclosed: CVE published