Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120684— MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

Quick assessment

Affected

MongoDB C Driver

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB C 驱动中遗留的 GridFS 文件处理机制存在内存初始化缺陷，可能导致未初始化的进程内存被误判为有效文件内容并存储到服务器上。拥有共享存储区域普通写入权限的数据库用户可以构造特定条件，使得后续应用程序在追加此类文件时，将上述未初始化内存写入该用户同样被授权读取的记录中，从而导致应用程序进程中的敏感信息（包括凭据）被意外泄露。

CVSS 6.5 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing

Affected Version Matrix 2

Vendor	Product	Version Range	Status
MongoDB	C Driver	`1.25.0≤ 1.30.14`	affected
		`2.0.0≤ 2.5.7`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

Source: CVE Program / CVE List V5

Vulnerability Description

A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对未经初始化资源的使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MongoDB	C Driver	1.25.0 ~ 1.30.14	-

II. Public POCs for CVE-2026-120684

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120684

请登录查看更多情报信息。

Other References for CVE-2026-120684 (1)

https://jira.mongodb.org/browse/CDRIVER-6508

https://www.cve.org/CVERecord?id=CVE-2026-120684

Same Patch Batch · MongoDB · 2026-11-03 · 15 CVEs total

CVE-2026-119675	8.6 HIGH	mongorestore may bypass collection guards through a system.buckets prefix
CVE-2026-120678	7.5 HIGH	MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to
CVE-2026-120955	7.5 HIGH	MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120956	7.1 HIGH	remote abort and memory disclosure from a malformed cursor.ns
CVE-2026-120952	7.1 HIGH	MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID t
CVE-2026-119179	7.0 HIGH	MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expo
CVE-2026-120673	5.5 MEDIUM	Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
CVE-2026-120567	5.4 MEDIUM	ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
CVE-2026-119672	4.8 MEDIUM	mongofiles may disclose GridFS content to standard output through a stored filename
CVE-2026-120953	4.3 MEDIUM	Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-co
CVE-2026-119674	3.7 LOW	mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954	3.7 LOW	Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-120959	3.7 LOW	MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-arra
CVE-2026-119673	2.8 LOW	mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same product: C Driver

Same vendor: MongoDB

Same weakness: CWE-908