CVE-2026-88029: mongodb python_driver
CVSS: 8.3v3.1HighAnalyzed
AliasesGHSA-8fvv-fgr5-f8chUBUNTU-CVE-2026-88029DEBIAN-CVE-2026-88029CGA-2x47-jhc4-gwvpCGA-3q8c-jc66-gghfCGA-5j5g-fqhf-x77fCGA-68cv-rqx5-v5h8CGA-8mhv-f363-2c96CGA-gc2g-c3p7-h9f6CGA-m557-249p-5m65CGA-qwq5-6f6q-3h9rCGA-v6pr-wjhp-86w8CGA-wqq2-38pc-xc2popenSUSE-SU-2026:11808-1CGA-2cj3-qvvr-5xm7CGA-2f3p-gw2r-gqpwCGA-3vpr-5gp2-r4rvCGA-4v6w-rcp7-79w8CGA-4vjr-4x8g-r5c9CGA-5j7h-65g3-c55xCGA-6r97-hqff-6vffCGA-73pw-w8g5-xfjwCGA-789j-7347-pg4wCGA-7wf7-hr45-7vv3CGA-7wpg-66r3-pj35CGA-8375-gh6w-w35xCGA-87xp-4vj5-vc6jCGA-8r77-mf9w-p864CGA-939v-jq88-vf78CGA-9pp4-r289-8w2jCGA-f6w2-r7ff-jggpCGA-fj8q-39v6-2hfhCGA-h2w3-62rq-7895CGA-jm84-wv7p-wf9jCGA-m5fw-mj59-8p8vCGA-m6vp-36cc-7ggcCGA-pcg2-97cv-wv6qCGA-qrvc-m36h-7jvgCGA-qrw9-c66j-v2rfCGA-v8x6-rhqm-496hCGA-vm43-wr28-wjfpCGA-x4h9-f4f4-f8jrCGA-x5cx-9jq7-jqqwCGA-xg63-595c-mwv8CGA-xgx7-5c8q-5qp8CGA-xrq3-4rhc-v4chRHSA-2026:82858PYSEC-2026-4294
Published 10-09-2026Last modified 10-09-2026
Vulnerability summary
CVE-2026-88029 is a high (CVSS 8.3) vulnerability in mongodb python_driver. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.2% of scored vulnerabilities.
CVSS score
8.3/10
010
High · v3.1 (CVE.org)EPSS score
0.27%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 1 · Downstream 0Timeline
- 10-09-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
CVSS metrics
11 scores · 8 sources · 2 versionsMedium 6.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST6.1MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 8.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- NVDNIST8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
+0.01 pp
From 0.26% on 19-09-2026
19-09-202619-10-2026
EPSS score0.27%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat39 products
- python-distro< 0:1.4.0-2.module+el8.10.0+20784+edafcd43
- python-docs< 0:3.6.7-2.module+el8.10.0+20784+edafcd43
- python-docutils< 0:0.14-12.module+el8.10.0+20784+edafcd43
- python-nose< 0:1.3.7-31.module+el8.10.0+20784+edafcd43
- python-nose-docs< 0:1.3.7-31.module+el8.10.0+20784+edafcd43
Chainguard21 products
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.79-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.80-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.81-core-integrations< 7.81.3-r10
Wolfi5 products
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.79-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.80-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.81-core-integrations< 7.81.3-r10
Debian1 product
- pymongoAll versions (No fix recorded) | < 4.18.1-1
Mongodb1 product
- python_driver≥ 1.6.0, < 4.18.1 | ≥ 1.6, < 4.18.1
Opensuse1 product
- python-pymongo&distro=openSUSE Tumbleweed< 4.18.1-1.1
PyPI1 product
- pymongo< 4.18.1
Ubuntu1 product
- pymongoAll versions (No fix recorded)
8 vendors · 70 products
References
21 links
Show all 21 references
- pypi.org/project/pymongoPACKAGE