MongoDB Python Driver: Data disclosure and denial of service via query-operator injection

Published September 10, 2026 CVE-2026-88029

MongoDB's Python Driver can let an authenticated user read stored files they should not access. They can also remove all pieces of files in a GridFS bucket, making those files unreadable.

Severity
HighCVSS 3.1 · 8.3
Fix
Fixed in 4.18.1
Affected versions
1.6.0 to before 4.18.1
Weakness
CWE-943
Exploit likelihood
0.26% in 30 daysEPSS, higher than 18% of known flaws
Affects
Python Driver
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75665ENISA vulnerability database

How it works

  • An authenticated user must be able to influence a file identifier passed to GridFS.
  • The driver can treat that identifier as a database query instead of one exact file identifier.
  • This can expose other stored content or remove every piece of every file in the affected bucket.
  • The rename operation can also change a different stored file than intended.

What to do

Run python3 -m pip show pymongo and compare the installed Version with 4.18.1. Versions from 1.6.0 through versions less than 4.18.1 are affected when the application uses GridFS operations with user-controlled file identifiers.

Run this in the application environment you want to check:

python3 -m pip show pymongo

Update pymongo to version 4.18.1 or later, then verify the installed version again with python3 -m pip show pymongo.

Technical details

CVE-2026-88029 affects GridFS operations in the MongoDB Python Driver. A structured file identifier supplied by the caller can be interpreted as query logic rather than as one literal identifier, allowing unauthorized reads, bucket-wide file-chunk deletion, or an unintended rename. The affected range is 1.6.0 through versions less than 4.18.1.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact Low Some data can be read
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H Open in FIRST.org calculator

References

View Original Source