GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver
Priority LOW 27CWE-943Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Partial Red Hat: 10 fixed, 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Fix Partial Python Driver (MongoDB): 4.18.1pymongo (PyPI): 4.18.1Red Hat: 7 advisoriesRed Hat: 10 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MongoDB | Python Driver | 1.6.0 to before 4.18.1 | 4.18.1 | Patch available | CNA |
| — | pymongo (PyPI) | before 4.18.1 | 4.18.1 | Patch available | GHSA-8fvv-fgr5-f8ch |
- Python Driver VendorMongoDB Affected 1.6.0 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
- pymongo (PyPI) Vendor— Affected before 4.18.1 Fixed in 4.18.1 Patch available GHSA-8fvv-fgr5-f8ch
Remediation
- Fix · CNA Python Driver (MongoDB) Fixed in 4.18.1
- Fix · GHSA-8fvv-fgr5-f8ch pymongo (PyPI) Fixed in 4.18.1 Advisory →
Red Hat 7 advisories
- RHSA-2026:95583 Released 2026-11-05 · Red Hat rating Importantpython36:3.6 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) python-PyMySQL-0.10.1-2.module+el8.4.0+9657+a4b6a102.src::python36:3.6, python-distro-1.4.0-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6, python-docs-3.6.7-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6 +31
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) python-PyMySQL-0.10.1-2.module+el8.4.0+9657+a4b6a102.src::python36:3.6, python-distro-1.4.0-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6, python-docs-3.6.7-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6 +31
- RHSA-2026:95580 Released 2026-11-05 · Red Hat rating Importantpython36:3.6 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) python-PyMySQL-0.10.1-2.module+el8.4.0+9657+a4b6a102.src::python36:3.6, python-distro-1.4.0-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6, python-docs-3.6.7-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6 +31
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) python-PyMySQL-0.10.1-2.module+el8.4.0+9657+a4b6a102.src::python36:3.6, python-distro-1.4.0-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6, python-docs-3.6.7-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6 +31
- RHSA-2026:95578 Released 2026-11-05 · Red Hat rating Importantpython36:3.6 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) python-PyMySQL-0.10.1-2.module+el8.4.0+9657+a4b6a102.src::python36:3.6, python-distro-1.4.0-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6, python-docs-3.6.7-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6 +39
- Red Hat Enterprise Linux AppStream TUS (v.8.8) python-PyMySQL-0.10.1-2.module+el8.4.0+9657+a4b6a102.src::python36:3.6, python-distro-1.4.0-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6, python-docs-3.6.7-2.module+el8.1.0+3334+5cb623d7.src::python36:3.6 +31
Show 4 more Red Hat advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:86891 Released 2026-10-21 · Red Hat rating CriticalRHOAI 3.5.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:82858 Released 2026-10-14 · Red Hat rating Importantpython36:3.6 security update
- Red Hat Enterprise Linux AppStream (v. 8) python-PyMySQL-0.10.1-2.module+el8.10.0+20784+edafcd43.src::python36:3.6, python-distro-1.4.0-2.module+el8.10.0+20784+edafcd43.src::python36:3.6, python-docs-3.6.7-2.module+el8.10.0+20784+edafcd43.src::python36:3.6 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:82858 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:95583 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:95580 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:95578 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:95583 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:95580 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:95578 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:86891 |
Not affected: 4 products
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5
- Red Hat OpenStack Platform 17.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-88029
- 2026-10-03 Alias added: GHSA-8h2c-ghff-mpg9
- 2026-10-06 Alias added: GHSA-8fvv-fgr5-f8ch
- 2026-10-06 Fix available: PyPI/[email protected] · GHSA-8fvv-fgr5-f8ch
- 2026-10-06 CVSS score added · GHSA-8fvv-fgr5-f8ch
- 2026-10-06 Weakness changed · GHSA-8fvv-fgr5-f8ch
- 2026-10-06 8 new references · GHSA-8fvv-fgr5-f8ch
- 2026-10-08 Affected versions changed · Red Hat
- 2026-10-15 Fix available: RHSA-2026:82858 · Red Hat
- 2026-10-16 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
- 2026-11-05 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.8) +3 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95580 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95583 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95578 · Red Hat
References
Advisory 2
Other 7
- https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-8fvv-fgr5-f8ch
- https://github.com/mongodb/mongo-python-driver/pull/3046
- https://github.com/mongodb/mongo-python-driver/commit/3ef1c607859589a0086446ad6f557791a2813681
- https://github.com/mongodb/mongo-python-driver/commit/fa676586ba4b399168a4d1d41c30dc2166cc44fd
- https://github.com/mongodb/mongo-python-driver
- https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.1
- https://jira.mongodb.org/browse/PYTHON-5992
More MongoDB Python Driver vulnerabilities
- TI-2026-69752 Out-of-bounds read in MongoDB Python Driver BSON decoding crashes CVSS 4.0MEDIUM 5.9
Sources
- CVE-2026-88029 · CVE Program
- CVE-2026-88029 · NVD
- FIRST EPSS
- GHSA-8fvv-fgr5-f8ch · GitHub Advisory Database · CC BY 4.0
- GHSA-8h2c-ghff-mpg9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-88029 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences