CVE-2026-96748: mongodb python_driver
CVSS: 8.3v4.0HighAwaiting analysis
AliasesGHSA-vp6j-j7w5-5xjjUBUNTU-CVE-2026-96748DEBIAN-CVE-2026-96748CGA-68q7-x6qq-q5jrCGA-9vph-r7rm-xfjrCGA-j82h-h3c4-hfjwCGA-jfqp-6mvq-wrv8CGA-m8pc-g3m7-gwpfCGA-mmwr-5mp3-h585CGA-pcc7-6j4q-cf67CGA-v5xm-cm9p-2q29CGA-vxcc-h3cq-8pv9CGA-xjh6-cwwv-gqc5CGA-2qj4-7fcp-m38cCGA-52cm-997m-hxpgCGA-666x-7g35-2vjvCGA-8769-g4gv-hqmvCGA-8j9r-7r4g-j992CGA-9wvf-gw2q-4368CGA-ff3g-2484-2f4vCGA-fh3q-mj6x-rg88CGA-fr88-xr64-78p3CGA-g9c8-whhg-vm5xCGA-ghxr-jm8c-q96jCGA-gxch-xfxc-6cx6CGA-h9wr-v275-r9p8CGA-j7ff-p4rj-fq7mCGA-jcj4-g7pg-92m3CGA-jh9q-j2g4-p36jCGA-m69v-97cj-3qhxCGA-m8p2-wg2c-r524CGA-p2w4-jh8p-xq7qCGA-p3wr-7f2h-qr2jCGA-ppmm-4hgv-24jcCGA-x82w-jwq5-v827CGA-q655-f3vp-4fg4CGA-qf8g-642x-jfrjCGA-qw63-h9p3-9c4cCGA-r8wv-2x3m-rj4qCGA-rj82-hcrx-q6xpCGA-rmc8-g584-4phfCGA-rx3v-g4fv-5wgpCGA-vp83-8xw3-qv4mCGA-vp9q-77vq-443vCGA-w8p8-9xwc-32r8PYSEC-2026-4297
Published 24-09-2026Last modified 24-09-2026
Vulnerability summary
CVE-2026-96748 is a high (CVSS 8.3) vulnerability in mongodb python_driver. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.2% of scored vulnerabilities.
CVSS score
8.3/10
010
High · v4.0 (CVE.org)EPSS score
0.26%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 24-09-2026PublishedVulnerability first disclosed.
- 24-09-2026Last modifiedVulnerability information updated.
Description
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.
CVSS metrics
11 scores · 7 sources · 2 versionsHigh 8.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
25-09-202619-10-2026
EPSS score0.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard21 products
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.79-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.80-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.81-core-integrations< 7.81.3-r10
Wolfi5 products
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.79-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.80-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.81-core-integrations< 7.81.3-r10
Debian1 product
- pymongoAll versions (No fix recorded) | < 4.18.2-1
Mongodb1 product
- python_driver< 4.18.2
PyPI1 product
- pymongo≥ 3.5.0, < 4.18.2
Ubuntu1 product
- pymongoAll versions (No fix recorded)
6 vendors · 30 products
References
15 links
Show all 15 references
- pypi.org/project/pymongoPACKAGE