CVE-2026-96744— Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel
Quick assessment
Affected
MongoDB Laravel MongoDB (PHP)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Laravel 的 MongoDB 集成模块中，缓存锁实现的查询逻辑对特殊元素的转义处理不当，可能导致调用者提供的锁持有者（owner）值被当作聚合表达式而非字面量进行求值。具有认证权限且能够影响应用程序在获取或恢复锁时所使用的持有者值的用户，可能接管由其他进程持有的锁，或使其提前过期，从而导致重复或冲突的操作。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96744
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | Laravel MongoDB (PHP) | 4.3.0 ~ 5.11.0 | - |
|
II. Public POCs for CVE-2026-96744
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96744
请登录查看更多情报信息。
Other References for CVE-2026-96744 (2)
Same Patch Batch · MongoDB · 2026-09-24 · 7 CVEs total
| CVE-2026-96749 | 8.4 HIGH | Heap out-of-bounds write via signed size overflow in BSON document encoding |
| CVE-2026-96750 | 7.1 HIGH | Shell script injection via server-supplied database name in Open MongoDB shell |
| CVE-2026-96746 | 6.5 MEDIUM | Heap buffer overflow via mid-scan command list growth in client topology monitoring |
| CVE-2026-96748 | 6.5 MEDIUM | Connection redirection via percent-encoded delimiter injection in connection string hosts |
| CVE-2026-96745 | 5.6 MEDIUM | PHP object injection via unsuppressible __pclass class inference in command monitoring eve |
| CVE-2026-96747 | 5.0 MEDIUM | Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encrypt |
IV. Related Vulnerabilities
Same vendor: MongoDB
-
CVE-2026-96749
Heap out-of-bounds write via signed size overflow in BSON do -
CVE-2026-96748
Connection redirection via percent-encoded delimiter injecti -
CVE-2026-96747
Forced local Unix socket connection via dot-sock KMS endpoin -
CVE-2026-96745
PHP object injection via unsuppressible __pclass class infer -
CVE-2026-96746
Heap buffer overflow via mid-scan command list growth in cli
Same weakness: CWE-943
-
CVE-2026-100631
Parse Server 9.0.0 Unauthenticated Installation Deletion via -
CVE-2026-97228
Rapid7 Bulk Export MCP — GraphQL Query Injection in Export S -
CVE-2026-91133
Discourse: Escape LIKE metacharacters in upload paths to pre -
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via -
CVE-2026-20284
Cisco Identity Search Engine SXP REST API SQL Injection Vuln
V. Comments for CVE-2026-96744
No comments yet