MongoDB Rust Driver (GridFS): Data disclosure and deletion

Published September 10, 2026 CVE-2026-88024

MongoDB Rust Driver can let authenticated users read stored file content beyond its intended target. They can also remove all file chunks in an affected bucket, making that content unreadable.

Severity
HighCVSS 3.1 · 8.3
Fix
Fixed in 3.9.1
Affected versions
2.4.0 to before 3.9.1
Weakness
CWE-943
Exploit likelihood
0.32% in 30 daysEPSS, higher than 25% of known flaws
Affects
Rust Driver
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75638ENISA vulnerability database

How it works

  • An authenticated user influences a file identifier handled by an affected application.
  • The driver interprets part of that identifier as a database query condition instead of a literal file ID.
  • This can expose unintended stored content or remove every GridFS file chunk in the affected bucket.

What to do

Check whether the application uses MongoDB's Rust Driver, then compare its version with the affected range from 2.4.0 through before 3.9.1. A vulnerable version does not prove that stored content was accessed or became unreadable.

Update the MongoDB Rust Driver to version 3.9.1 or later, then confirm the application uses that dependency version.

Technical details

CVE-2026-88024 affects the GridFS component of MongoDB's Rust Driver. An authenticated user who can influence a file identifier may access stored content beyond the intended target or remove all GridFS file chunks in the affected bucket, making stored content unreadable.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact Low Some data can be read
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H Open in FIRST.org calculator

References

View Original Source