CVE-2026-96747: mongodb python_driver Server-Side Request Forgery (SSRF)
CVSS: 5.3v4.0MediumAwaiting analysis
AliasesGHSA-qx36-8mw2-4r3xUBUNTU-CVE-2026-96747DEBIAN-CVE-2026-96747CGA-3q98-wxfr-9mf3CGA-546w-j562-58cgCGA-6m79-rgw2-r8ccCGA-742w-w944-x9x5CGA-7v47-h4j9-3w5cCGA-9rf6-2hfg-vrv7CGA-c5mw-hf78-9pj3CGA-cx3m-x8cw-g5fxCGA-qv99-mc79-jw76CGA-rg99-26r6-53qcCGA-243x-fr2q-x2vhCGA-3xw2-4p8p-hwjrCGA-5qhv-gvv6-6vvrCGA-6qh4-q627-x9phCGA-834m-467q-g93fCGA-85wm-j6p4-8gfhCGA-87gg-m472-xfh5CGA-937m-m2jx-gwg2CGA-9vm7-pxr7-vwxvCGA-9vrh-vvpv-qwqxCGA-cvcr-4p34-2c23CGA-cx7w-qw9p-gmr4CGA-f33x-h72j-vc5hCGA-fq49-j69x-856xCGA-gvcg-9x85-gjxqCGA-h6jf-j8fv-gp8mCGA-j85r-fh8w-cwvwCGA-jjwg-5mj9-jv5hCGA-mf2c-m7gj-9956CGA-mj3h-mpmr-vr7rCGA-p627-24c3-98grCGA-pg45-rj8x-3qjxCGA-px2h-gcw3-r2c8CGA-pxch-cq3f-f6m7CGA-q3ch-4w44-mmh5CGA-q9r5-6hmg-mqmmCGA-qj65-9fp6-hvwpCGA-qw8c-c569-qhm6CGA-r46x-533m-h7jwCGA-wfqx-w3j6-3q79CGA-x84f-mg5p-2v77CGA-xfqh-jfw4-w8r2PYSEC-2026-4295
Published 24-09-2026Last modified 24-09-2026
Vulnerability summary
CVE-2026-96747 is a medium (CVSS 5.3) Server-Side Request Forgery (SSRF) vulnerability in mongodb python_driver. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v4.0 (CVE.org)EPSS score
0.13%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 24-09-2026PublishedVulnerability first disclosed.
- 24-09-2026Last modifiedVulnerability information updated.
Description
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
CVSS metrics
11 scores · 7 sources · 2 versionsMedium 5.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:NSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
- NVDNIST5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- NVDNIST5.0MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
25-09-202619-10-2026
EPSS score0.13%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard21 products
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.79-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.80-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.81-core-integrations< 7.81.3-r10
Wolfi5 products
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.79-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.80-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.81-core-integrations< 7.81.3-r10
Debian1 product
- pymongoAll versions (No fix recorded) | < 4.18.2-1
Mongodb1 product
- python_driver≥ 3.9.0, < 4.18.2
PyPI1 product
- pymongo≥ 3.9.0, < 4.18.2
Ubuntu1 product
- pymongoAll versions (No fix recorded)
6 vendors · 30 products
References
15 links
Show all 15 references
- pypi.org/project/pymongoPACKAGE