Read the docs
TI-2026-60058 Aliases CVE-2026-88033

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

Priority LOW 28CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Partial Java Driver (MongoDB): 5.11.1Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBJava Driver3.3.0 to before 5.11.15.11.1Patch availableCNA
  • Java Driver VendorMongoDB Affected 3.3.0 to before 5.11.1 Fixed in 5.11.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*3.3.0 to before 5.11.1VulnerableMongoDB
  • cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* Versions 3.3.0 to before 5.11.1 Vulnerable ·MongoDB

Remediation

  • Fix · CNA Java Driver (MongoDB) Fixed in 5.11.1

Red Hat 3 advisories

  • RHSA-2026:83670 Released 2026-10-15 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)
    • Red Hat Build of Apache Camel 3.33.4.redhat com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar, io.micrometer.micrometer-core-1.16.7.redhat-00002.jar +14
  • RHSA-2026:83520 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.4 release and security update
    • Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
  • RHSA-2026:83082 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.6 release and security update
    • Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB Java Driver 5.11.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-60057 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java DriverPriority LOW 35
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.4.redhatFixed RHSA-2026:83670
Red Hat build of Quarkus 3.27.6.redhatFixed RHSA-2026:83082
Red Hat build of Quarkus 3.33.4.redhatFixed RHSA-2026:83520
Not affected: 5 products
  • Exploit Intelligence
  • Red Hat Build of Apache Camel 3.33.4.redhat
  • Red Hat Fuse 7
  • Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat build of Quarkus 3.33.4.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88033
  2. 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
  3. 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
  4. 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat
  5. 2026-11-06 Fix available: Red Hat Build of Apache Camel 3.33.4.redhat · Red Hat
  6. 2026-11-06 Fix available: RHSA-2026:83670 · Red Hat

References

Advisory 1

  • TI-2026-60057 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver CVSS 4.0HIGH 8.2
  • TI-2026-15335 Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization CVSS 4.0HIGH 8.2
  • TI-2021-03616 MongoDB Java driver client-side field level encryption not verifying KMS host name CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences