Medium severity5.0NVD Advisory· Published Sep 24, 2026· Updated Sep 24, 2026
CVE-2026-96747
CVE-2026-96747
Description
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pymongoPyPI | >= 3.9.0, < 4.18.2 | 4.18.2 |
Affected products
3- osv-coords2 versionspkg:rpm/opensuse/python-pymongo&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-pymongo&distro=openSUSE%20Tumbleweed
< 4.6.3-bp160.2.1+ 1 more
- (no CPE)range: < 4.6.3-bp160.2.1
- (no CPE)range: < 4.18.2-1.1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-qx36-8mw2-4r3xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-96747ghsaADVISORY
- github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rstnvdWEB
- github.com/mongodb/mongo-python-driver/commit/44119d0f9dfa0224d84b03be702a6d9a5ef1dea7ghsaWEB
- github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7ghsaWEB
- github.com/mongodb/mongo-python-driver/pull/3066ghsaWEB
- github.com/mongodb/mongo-python-driver/releases/tag/4.18.2nvdWEB
- github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3xnvdWEB
- www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732ghsaWEB
News mentions
1- MongoDB: Seven Vulnerabilities Disclosed Across Drivers and Compass on Sep 24, 2026Vypr Intelligence · Sep 24, 2026