CVE-2026-119675 in Database Tools
Summary
by MITRE • 11/03/2026
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in MongoDB Database Tools, specifically within the mongorestore utility, represents a critical flaw in how collection names are validated during the restoration of untrusted data dumps. The core technical issue stems from an inconsistent handling of the system.buckets prefix when validating collection names against security filters designed to prevent unauthorized modifications to internal database structures. In normal operation, MongoDB employs strict guards and operator namespace filters to ensure that users cannot inadvertently or maliciously overwrite critical system collections such as those containing user accounts, roles, or authentication data. However, due to a logic error in the validation routine, specially crafted collection names can bypass these protective mechanisms. This inconsistency allows an attacker to manipulate the restoration process into creating unauthorized database entities, including new user accounts with elevated privileges that were not intended by the operator performing the restore operation.
The operational impact of this vulnerability is severe because it directly compromises the integrity and security posture of MongoDB deployments. An adversary who gains access to untrusted data dumps or can influence the content of such dumps can exploit this flaw to create a new user account with the root role on the target deployment. This effectively grants the attacker full administrative control over the database, allowing them to read, modify, or delete any data stored within the system. The vulnerability is particularly dangerous because it requires an operator to restore unauthorized user-controlled data using credentials that possess sufficient privileges for user management. In many operational environments, administrators routinely import large datasets from external sources or backup files without thoroughly inspecting every collection name, making this a plausible attack vector in real-world scenarios.
It is important to note that standard mitigation strategies such as excluding the admin namespace are insufficient to prevent exploitation of this specific flaw. The vulnerability affects MongoDB Database Tools versions 100.4.0 through versions prior to 100.20.1, indicating a widespread exposure across multiple releases where the validation logic was not rigorously enforced against edge cases involving system prefixes. This highlights the necessity for comprehensive input sanitization rather than relying on simple namespace exclusions which can be circumvented by crafted inputs that do not explicitly target the admin database but instead exploit inconsistencies in how other system-related collections are processed during restoration.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection if interpreted broadly as improper neutralization of special elements used in an operating system command or application context, though more accurately it falls under CWE-94 Improper Control of Generation of Code (Code Injection) regarding the creation of unauthorized database objects. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Account Manipulation and potentially Persistence if the created account is used for long-term access. The attack vector leverages the trust placed in restoration tools by operators who may not anticipate that a restore operation could result in privilege escalation through user creation rather than just data overwriting.
To mitigate this risk, organizations must immediately upgrade MongoDB Database Tools to version 100.20.1 or later where these validation inconsistencies have been addressed. Until the upgrade is performed, administrators should exercise extreme caution when restoring dumps from untrusted sources and consider implementing additional layers of verification before executing restore commands with high-privilege accounts. It is also advisable to audit existing deployments for any unauthorized user accounts that may have been created through exploitation attempts if there is a suspicion that vulnerable versions were used in the past. Regular security assessments and adherence to least privilege principles when assigning credentials to restoration processes can further reduce the likelihood of successful exploitation by limiting the scope of damage even if an attacker manages to bypass initial validation checks.