MongoDB PyMongo up to 4.18.1 Connection String hostname input validation

Summaryinfo

A vulnerability, which was classified as critical, was found in MongoDB PyMongo up to 4.18.1. Affected by this issue is some unknown functionality of the component Connection String. The manipulation of the argument Hostname results in input validation. This vulnerability is known as CVE-2026-96748. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in MongoDB PyMongo up to 4.18.1. It has been classified as critical. Affected is some unknown functionality of the component Connection String. The manipulation of the argument hostname with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-96748 since 09/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 350277 (Linux Distros Unpatched Vulnerability : CVE-2026-96748), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.18.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (350277). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• PyMongo

Version

• 4.18.0
• 4.18.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion