---
id: "CVE-2026-119674"
kind: "vulnerability"
aliases: ["CVE-2026-119674"]
title: "MongoDB Database Tools: mongorestore can write documents into the wrong collection"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mongodb", "mongodb-database-tools", "mongorestore", "package", "self-hosted"]
not_affected_if: ["not-using-mongorestore", "single-trusted-dumps", "versions-outside-range"]
published_at: "2026-11-03T17:18:06+00:00"
first_seen_at: "2026-11-03T17:21:56+00:00"
updated_at: "2026-11-03T17:24:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119674", "first_seen_at": "2026-11-03T17:21:56+00:00"}]
---

# MongoDB Database Tools: mongorestore can write documents into the wrong collection

MongoDB Database Tools' mongorestore URL-decodes collection names read from dump metadata incorrectly when the dump filename was truncated. A database user who can create a specially encoded collection can redirect a later directory restore into a collection they cannot write to directly, which can drop backed-up documents or replace the destination with --drop.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mongorestore --version` on hosts that restore MongoDB directory dumps and compare against the affected range `100.0.2` through before `100.20.1`.
- Check whether any restore pipeline uses directory dumps that include collection names from untrusted database users.

## Fix

- MongoDB Database Tools `100.20.1` or later (the first fixed version, per the affected range given).

## Timeline

- 2026-11-03T17:21:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119674

## From the sources

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_