CVE-2026-96747— Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
Quick assessment
Affected
MongoDB Python Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB Python 驱动程序中的客户端字段级加密支持存在一个缺陷：当密钥管理端点的值以“.sock”结尾时，驱动程序会将其视为本地 Unix 域套接字路径，而非远程主机。具有数据库中对加密密钥元数据的写权限的用户，可致使使用该驱动程序的应用程序在应用主机上打开到本地套接字的连接。通过此类连接传输的数据仅限于 TLS 握手的起始部分，因此不会传输任何用户选择的内容。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96747
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
Source: CVE Program / CVE List V5
Vulnerability Description
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | Python Driver | 3.9.0 ~ 4.18.2 | - |
|
II. Public POCs for CVE-2026-96747
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96747
请登录查看更多情报信息。
Other References for CVE-2026-96747 (3)
Same Patch Batch · MongoDB · 2026-09-24 · 7 CVEs total
| CVE-2026-96749 | 8.4 HIGH | Heap out-of-bounds write via signed size overflow in BSON document encoding |
| CVE-2026-96750 | 7.1 HIGH | Shell script injection via server-supplied database name in Open MongoDB shell |
| CVE-2026-96744 | 7.1 HIGH | Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB |
| CVE-2026-96746 | 6.5 MEDIUM | Heap buffer overflow via mid-scan command list growth in client topology monitoring |
| CVE-2026-96748 | 6.5 MEDIUM | Connection redirection via percent-encoded delimiter injection in connection string hosts |
| CVE-2026-96745 | 5.6 MEDIUM | PHP object injection via unsuppressible __pclass class inference in command monitoring eve |
IV. Related Vulnerabilities
Same vendor: MongoDB
-
CVE-2026-96749
Heap out-of-bounds write via signed size overflow in BSON do -
CVE-2026-96748
Connection redirection via percent-encoded delimiter injecti -
CVE-2026-96745
PHP object injection via unsuppressible __pclass class infer -
CVE-2026-96746
Heap buffer overflow via mid-scan command list growth in cli -
CVE-2026-96750
Shell script injection via server-supplied database name in
Same weakness: CWE-918
-
CVE-2026-82375
Apache Roller: Server-side request forgery via entry trackba -
CVE-2026-100750
Joomla Extension - regularlabs.com - Arbitrary file read / S -
CVE-2026-101005
October CMS SSRF Protection ResizeImages.php validateExterna -
CVE-2026-100909
OctoberCMS ResizeImages.php getSourcePathForResize server-si -
CVE-2026-100901
athlon1600 youtube-downloader stream.php stream server-side
V. Comments for CVE-2026-96747
No comments yet