Read the docs
TI-2026-60056 Aliases CVE-2026-88031GHSA-gf3f-xg7m-h8wp

GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

Priority LOW 28CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 12 fixed, 40 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Partial Go Driver (MongoDB): 1.17.10, 2.9.1Red Hat: 14 advisoriesRed Hat: 12 fixed, 40 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBGo Driver1.0.0 to before 1.17.10; 2.0.0 to before 2.9.11.17.10, 2.9.1Patch availableCNA
  • Go Driver VendorMongoDB Affected 1.0.0 to before 1.17.10; 2.0.0 to before 2.9.1 Fixed in 1.17.10, 2.9.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:go_driver:*:*:*:*:*:mongodb:*:*1.0.0 to before 1.17.10; 2.0.0 to before 2.9.1VulnerableMongoDB
  • cpe:2.3:a:mongodb:go_driver:*:*:*:*:*:mongodb:*:* Versions 1.0.0 to before 1.17.10; 2.0.0 to before 2.9.1 Vulnerable ·MongoDB

Remediation

  • Fix · CNA Go Driver (MongoDB) Fixed in 1.17.10, 2.9.1

Red Hat 14 advisories

  • RHSA-2026:95517 Released 2026-11-05 · Red Hat rating Important
    Multicluster Global Hub 1.7.4 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:95360 Released 2026-11-04 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9
  • RHSA-2026:94612 Released 2026-11-03 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.2 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
Show 11 more Red Hat advisories
  • RHSA-2026:94608 Released 2026-11-03 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.2 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:92307 Released 2026-10-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +16
  • RHSA-2026:91646 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) osbuild-composer-134.1-13.el10_0, osbuild-composer-core-134.1-13.el10_0, osbuild-composer-worker-134.1-13.el10_0
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:90314 Released 2026-10-26 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.31.0 RHEL 10 Container Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/udi-base-rhel10
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:85846 Released 2026-10-20 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.18 security and bug fix update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8 +1
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83662 Released 2026-10-15 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.11 registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9 +1
  • RHSA-2026:72849 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.3 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Compliance OperatorAffectedNo fix yet
ExternalDNS OperatorAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
MCP Server for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for ContainersAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift API for Data ProtectionAffectedNo fix yet
OpenShift LightspeedAffectedNo fix planned: Will not fix
OpenShift PipelinesAffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Edge Manager 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4Affected—
Red Hat OpenShift distributed tracing 3Affected—
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Service Interconnect 2AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix planned: Will not fix
Red Hat Web TerminalAffectedNo fix yet
Security Profiles OperatorAffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:95360
Migration Toolkit for Virtualization 2.11Fixed RHSA-2026:83662
Multicluster Global Hub 1.7.4Fixed RHSA-2026:95517
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:92307
Red Hat Edge Manager 1.2Fixed RHSA-2026:94608, RHSA-2026:94612
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:91646
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:85846
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90314, RHSA-2026:90321
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:72849
Not affected: 40 products
  • Confidential Compute Attestation
  • Cryostat 4 on RHEL 9
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • External Secrets Operator for Red Hat OpenShift
  • File Integrity Operator
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Migration Toolkit for Virtualization
  • Migration Toolkit for Virtualization 2.11
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.7.4
  • OpenShift Developer Tools and Services
  • OpenShift Serverless
  • OpenShift Service Mesh 3
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Ansible Automation Platform 2
  • Red Hat Edge Manager 1.2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Service Interconnect 2
  • Red Hat Trusted Artifact Signer
  • Zero Trust Workload Identity Manager
  • multicluster engine for Kubernetes 2.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88031
  2. 2026-10-03 Alias added: GHSA-gf3f-xg7m-h8wp
  3. 2026-10-05 Affected versions changed · Red Hat
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-08 Affected versions changed · Red Hat
  6. 2026-10-10 Affected versions changed · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:83662 · Red Hat
  8. 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.11 · Red Hat
  9. 2026-10-18 Affected versions changed · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:85846 · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  12. 2026-10-20 Fix available: Red Hat Migration Toolkit 1.8, Red Hat OpenShift AI 3.4 · Red Hat
  13. 2026-10-21 Affected versions changed · Red Hat
  14. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  15. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  16. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  17. 2026-10-24 Affected versions changed · Red Hat
  18. 2026-10-27 Affected versions changed · Red Hat
  19. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · Red Hat
  20. 2026-10-29 Fix available: RHSA-2026:91646 · Red Hat
  21. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  22. 2026-10-30 Fix available: RHSA-2026:90314 · Red Hat
  23. 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
  24. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  25. 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat
  26. 2026-11-04 Fix available: RHSA-2026:94612 · Red Hat
  27. 2026-11-04 Fix available: RHSA-2026:94608 · Red Hat
  28. 2026-11-04 Fix available: Red Hat Edge Manager 1.2 · Red Hat
  29. 2026-11-05 Fix available: Cryostat 4 on RHEL 9 · Red Hat
  30. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
  31. 2026-11-06 Fix available: RHSA-2026:95517 · Red Hat
  32. 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat

References

Advisory 1

  • TI-2026-69717 Denial of service in MongoDB Go Driver via malformed BSON array CVSS 4.0HIGH 8.2
  • TI-2026-69716 Integer overflow in MongoDB Go Driver BSON handling causes panic CVSS 4.0HIGH 8.2
  • TI-2021-03617 Specific cstrings input may not be properly validated in the Go Driver CVSS 3.1MEDIUM 6.8
  • TI-2026-56242 Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences