Do Son 
TL;DR
MongoDB issued security advisories detailing seven MongoDB driver vulnerabilities across its database ecosystem. These flaws allow remote attackers to redirect database connections, trigger heap memory corruption, or execute unauthorized code. System administrators must upgrade their client drivers and tools immediately to maintain secure database operations.
- Total: 7 CVEs
- Severity: 5 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 8.4 (High · CVSSv3) — CVE-2026-96749
- Action: Apply the latest security updates now
Route critical CVEs to one Slack channel, everything else to another.
Try Team free for 7 daysNotable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-96749 | 8.4 | Heap out-of-bounds write via signed size overflow in BSON document encoding | 4.18.2 | Not exploited |
| CVE-2026-96750 | 7.1 | Shell script injection via server-supplied database name in Open shell | 1.49.12 | Not exploited |
| CVE-2026-96744 | 7.1 | Unauthorized cache lock takeover via expression injection in lock owner values in integration for Laravel | 5.11.0 | Not exploited |
| CVE-2026-96748 | 6.5 | Connection redirection via percent-encoded delimiter injection in connection string hosts | 4.18.2 | Not exploited |
| CVE-2026-96746 | 6.5 | Heap buffer overflow via mid-scan command list growth in client topology monitoring | 1.30.12, 2.5.5 | Not exploited |
| CVE-2026-96745 | 5.6 | PHP object injection via unsuppressible __pclass class inference in command monitoring events | 1.21.10, 2.1.10, 2.5.3 | Not exploited |
| CVE-2026-96747 | 5 | Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption | 4.18.2 | Not exploited |
Why It Matters
Industry estimates show that tens of thousands of corporate applications connect to MongoDB databases daily. Consequently, weaknesses in official database drivers create substantial exposure for enterprise systems. The most severe issues carry CVSS ratings of 8.3. Furthermore, attackers can exploit some of these bugs to steal credentials or crash host processes. Security teams have confirmed no active exploitation in the wild. Additionally, researchers have not published any public proof-of-concept exploit code. Even so, these MongoDB driver vulnerabilities demand rapid remediation to avoid potential data tampering.
How The Attack Works
The security flaws target several distinct driver components and client utilities. Under CVE-2026-96748, PyMongo decodes percent-encoded characters in connection strings before splitting host delimiters. An unauthenticated attacker can supply crafted hostnames to add rogue database servers into client connection pools. As a result, the application sends authentication handshakes and queries to the rogue destination.
Meanwhile, CVE-2026-96749 involves a signed integer overflow during BSON encoding in the Python native extension. When an application encodes unusually large data, the routine writes outside allocated buffer boundaries. In the C Driver, CVE-2026-96746 causes a heap buffer overflow during client topology monitoring. Moreover, CVE-2026-96745 allows PHP object injection when monitoring subscribers parse untrusted documents. Finally, CVE-2026-96750 enables shell script injection in MongoDB Compass when users open the embedded shell.
Affected Versions
These flaws impact multiple official client libraries and administrative tools. For Python, PyMongo versions prior to 4.18.2 remain vulnerable. The C Driver flaw affects releases prior to 1.30.12 and 2.5.5. In addition, the PHP Driver vulnerability impacts versions before 1.21.10, 2.1.10, and 2.5.3. MongoDB Compass versions prior to 1.49.12 and Laravel MongoDB versions prior to 5.11.0 are also vulnerable.
Patch Or Mitigation Steps
Development teams must update their dependencies to fixed versions immediately. Python developers should install PyMongo 4.18.2 or later. Similarly, C and PHP teams must upgrade their drivers to the latest patch releases. You can find complete update instructions in the official MongoDB security alerts portal. In addition, update MongoDB Compass to version 1.49.12 to block shell injection attacks. Patching these MongoDB driver vulnerabilities keeps database connections protected against unauthorized redirection.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
