High severity8.3NVD Advisory· Published Sep 10, 2026· Updated Sep 29, 2026
CVE-2026-88029
CVE-2026-88029
Description
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pymongoPyPI | < 4.18.1 | 4.18.1 |
Affected products
26- osv-coords23 versionspkg:rpm/almalinux/python-nose-docspkg:rpm/almalinux/python-pymongo-docpkg:rpm/almalinux/python-sqlalchemy-docpkg:rpm/almalinux/python-virtualenv-docpkg:rpm/almalinux/python3-PyMySQLpkg:rpm/almalinux/python3-bsonpkg:rpm/almalinux/python3-distropkg:rpm/almalinux/python3-docspkg:rpm/almalinux/python3-docutilspkg:rpm/almalinux/python3-nosepkg:rpm/almalinux/python3-pygmentspkg:rpm/almalinux/python3-pymongopkg:rpm/almalinux/python3-pymongo-gridfspkg:rpm/almalinux/python3-scipypkg:rpm/almalinux/python3-sqlalchemypkg:rpm/almalinux/python3-virtualenvpkg:rpm/almalinux/python3-wheelpkg:rpm/almalinux/python3-wheel-wheelpkg:rpm/almalinux/python36pkg:rpm/almalinux/python36-debugpkg:rpm/almalinux/python36-develpkg:rpm/almalinux/python36-rpm-macrospkg:rpm/opensuse/python-pymongo&distro=openSUSE%20Tumbleweed
< 1.3.7-31.module_el8.9.0+3700+efebe9fd+ 22 more
- (no CPE)range: < 1.3.7-31.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 3.7.0-3.module_el8.10.0+4300+ca04280a
- (no CPE)range: < 1.3.2-3.module_el8.10.0+3769+3838165b
- (no CPE)range: < 15.1.0-23.module_el8.10.0+3937+b6a3652f
- (no CPE)range: < 0.10.1-2.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 3.7.0-3.module_el8.10.0+4300+ca04280a
- (no CPE)range: < 1.4.0-2.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 3.6.7-2.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 0.14-12.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 1.3.7-31.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 2.2.0-22.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 3.7.0-3.module_el8.10.0+4300+ca04280a
- (no CPE)range: < 3.7.0-3.module_el8.10.0+4300+ca04280a
- (no CPE)range: < 1.0.0-21.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 1.3.2-3.module_el8.10.0+3769+3838165b
- (no CPE)range: < 15.1.0-23.module_el8.10.0+3937+b6a3652f
- (no CPE)range: < 1:0.31.1-3.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 1:0.31.1-3.module_el8.9.0+3700+efebe9fd
- (no CPE)range: < 3.6.8-39.module_el8.10.0+3769+3838165b
- (no CPE)range: < 3.6.8-39.module_el8.10.0+3769+3838165b
- (no CPE)range: < 3.6.8-39.module_el8.10.0+3769+3838165b
- (no CPE)range: < 3.6.8-39.module_el8.10.0+3769+3838165b
- (no CPE)range: < 4.18.1-1.1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-8fvv-fgr5-f8chghsaADVISORY
- jira.mongodb.org/browse/PYTHON-5994nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2026-88029ghsaADVISORY
- github.com/mongodb/mongo-python-driver/commit/3ef1c607859589a0086446ad6f557791a2813681ghsaWEB
- github.com/mongodb/mongo-python-driver/commit/fa676586ba4b399168a4d1d41c30dc2166cc44fdghsaWEB
- github.com/mongodb/mongo-python-driver/pull/3046ghsaWEB
- github.com/mongodb/mongo-python-driver/releases/tag/4.18.1ghsaWEB
- github.com/mongodb/mongo-python-driver/security/advisories/GHSA-8fvv-fgr5-f8chghsaWEB
- jira.mongodb.org/browse/PYTHON-5992ghsaWEB
News mentions
1- MongoDB: 14 Vulnerabilities Disclosed, GridFS & Server Impacted in 24h WindowVypr Intelligence · Sep 11, 2026