Live › vulnerability › CVE-2026-119674
MongoDB Database Tools' mongorestore URL-decodes collection names read from dump metadata incorrectly when the dump filename was truncated. A database user who can create a specially encoded collection can redirect a later directory restore into a collection they cannot write to directly, which can drop backed-up documents or replace the destination with --drop.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams that run mongorestore against directory dumps, where a database user can create collections in the source data. Exposure depends on the restore path writing to a destination collection that the user cannot modify directly. Teams that do not use mongorestore on directory dumps, or that only restore trusted dumps, can skip it.
No product ranges from the sources yet.
mongorestore --version on hosts that restore MongoDB directory dumps and compare against the affected range 100.0.2 through before 100.20.1.100.20.1 or later (the first fixed version, per the affected range given).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-119674")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.