Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119675— mongorestore may bypass collection guards through a system.buckets prefix

Quick assessment

Affected

MongoDB Database Tools

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB 数据库工具中的在验证来自不可信转储文件的集合名称时，对前缀的处理存在不一致。攻击者可构造特殊的集合名称，绕过针对特殊集合的保护机制以及操作符命名空间过滤规则，从而在恢复过程中创建未经授权的、由用户自定义的数据库账户，包括拥有 root 角色的账户。利用此漏洞需要操作员使用具备目标部署上足够用户管理权限的凭据，恢复由攻击者控制的未授权数据。仅排除命名空间无法阻止此类行为。该问题影响 MongoDB 数据库工具 100.4.0 至 100.20.1 之前的所有版本。

CVSS 8.6 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1078.004 · Cloud Accounts T1068.004

Affected Version Matrix 1

Vendor	Product	Version Range	Status
MongoDB	Database Tools	`100.4.0< 100.20.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

mongorestore may bypass collection guards through a system.buckets prefix

Source: CVE Program / CVE List V5

Vulnerability Description

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

使用不正确的解析名称或索引

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MongoDB	Database Tools	100.4.0 ~ 100.20.1	-

II. Public POCs for CVE-2026-119675

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119675

请登录查看更多情报信息。

Other References for CVE-2026-119675 (1)

https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md

https://www.cve.org/CVERecord?id=CVE-2026-119675

Same Patch Batch · MongoDB · 2026-11-03 · 15 CVEs total

CVE-2026-120678	7.5 HIGH	MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to
CVE-2026-120955	7.5 HIGH	MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120956	7.1 HIGH	remote abort and memory disclosure from a malformed cursor.ns
CVE-2026-120952	7.1 HIGH	MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID t
CVE-2026-119179	7.0 HIGH	MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expo
CVE-2026-120684	6.5 MEDIUM	MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
CVE-2026-120673	5.5 MEDIUM	Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
CVE-2026-120567	5.4 MEDIUM	ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
CVE-2026-119672	4.8 MEDIUM	mongofiles may disclose GridFS content to standard output through a stored filename
CVE-2026-120953	4.3 MEDIUM	Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-co
CVE-2026-119674	3.7 LOW	mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954	3.7 LOW	Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-120959	3.7 LOW	MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-arra
CVE-2026-119673	2.8 LOW	mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same product: Database Tools

Same vendor: MongoDB

Same weakness: CWE-706