Live › vulnerability › CVE-2026-119675
A crafted collection name in an untrusted database dump can make mongorestore bypass its guards and create a database user the operator did not choose, including one with the root role. An attacker who supplies the dump can then log in to the destination database with that account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams that run mongorestore against a MongoDB deployment using a dump they did not create themselves, with credentials that can manage users. Exposure depends on restoring untrusted data; restores of dumps you produced yourself are not the described path. unknown whether the sources cover other restore paths.
No product ranges from the sources yet.
mongorestore --version and compare against the affected range100.20.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-119675")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.