MEDIUM 5.2 NVD

CVE-2026-119675

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.

References

https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md

Published: 2026-11-03 · Source: NVD · Feed updated: 2026-11-03

This medium severity vulnerability with a CVSS score of 5.2 was published on 2026-11-03 via NVD.

vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.