MongoDB: Seven Vulnerabilities Disclosed Across Drivers and Compass on Sep 24, 2026
Seven MongoDB vulnerabilities affecting drivers and Compass were disclosed on September 24, 2026, with High and Medium severities.
Key findings
- Seven MongoDB vulnerabilities disclosed together on September 24, 2026, impacting drivers and Compass.
- High severity flaws include integer overflow in Python driver's BSON encoding and potential code injection in MongoDB Compass.
- Connection string parsing and monitoring logic in C and Python drivers present risks of server injection and buffer overflows.
- Client-side encryption and deserialization vulnerabilities affect Python and PHP drivers, respectively.
- Laravel integration vulnerability allows authenticated users to influence query logic evaluation.
On September 24, 2026, a batch of seven vulnerabilities was disclosed across various MongoDB drivers and integrations, with a disclosure window spanning just three hours. These vulnerabilities, ranging in severity from Medium to High, impact components such as BSON encoding, connection string parsing, client-side field-level encryption, and command monitoring. The coordinated disclosure highlights potential risks for applications utilizing these MongoDB components.
Several vulnerabilities stem from improper handling of data and size arithmetic. CVE-2026-96749, a High severity flaw, involves an integer overflow in the BSON document encoding of the MongoDB Python Driver. This occurs when a document is built from a large amount of caller-supplied data, and the size arithmetic, performed using a signed 32-bit type, is not adequately guarded against overflow.
Another area of concern is connection string parsing and management. CVE-2026-96748, a Medium severity vulnerability in PyMongo, allows an unauthenticated party to inject additional servers into an application's connection string by exploiting how percent-encoded characters are decoded before host list delimiters are processed. Similarly, CVE-2026-96746, a High severity issue in the MongoDB C Driver, presents an out-of-bounds write in the connection-monitoring logic. An attacker controlling name resolution for hosts in a connection string could exploit this to write beyond a heap buffer, potentially crashing the application.
Security concerns also extend to data interpretation and potential code evaluation. CVE-2026-96750, a High severity vulnerability in MongoDB Compass, allows for database names to be interpolated without proper escaping into the embedded MongoDB shell. This could lead to unintended code evaluation under specific conditions when a user opens the shell from a database view. CVE-2026-96744, a High severity flaw in the MongoDB integration for Laravel, involves improper neutralization of special elements in query logic. An authenticated user influencing the lock owner value could cause it to be evaluated as an aggregation expression instead of a literal.
Client-side field-level encryption and deserialization vulnerabilities were also part of this disclosure. CVE-2026-96747, a Medium severity flaw, affects the MongoDB Python Driver's client-side field-level encryption. It can misinterpret a key management endpoint ending in ".sock" as a local Unix domain socket path instead of a remote host, potentially allowing a user with write access to encryption key metadata to affect applications using the driver. CVE-2026-96745, a Medium severity vulnerability in the MongoDB PHP Driver, arises from deserialization of untrusted data in command monitoring. This can lead to class names embedded in document content being honored when the driver builds monitoring event objects, posing a risk when applications use command monitoring subscribers with untrusted data.
The coordinated disclosure of these seven vulnerabilities across multiple MongoDB components underscores the importance of keeping drivers and tools updated. Users are advised to review the specific advisories for each affected component and apply patches or updates as recommended by MongoDB and the respective driver maintainers to mitigate potential risks. The tight disclosure window suggests a focused effort to address these issues concurrently.