MongoDB Database Tools vulnerabilities

Latest MongoDB Database Tools CVEs

Newest publication first

1. CVE-2026-119674 mongorestore may restore encoded collection names into an unintended collection

   Published 2026-11-03

   Low·CVSS 2.1 EPSS 0.16%

   MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory res...

2. CVE-2026-119673 mongofiles may write outside the working directory through a symlink

   Published 2026-11-03

   Low·CVSS 1.0 EPSS 0.15%

   MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to...

3. CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename

   Published 2026-11-03

   Medium·CVSS 5.9 EPSS 0.23%

   MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents...

4. CVE-2026-119675 mongorestore may bypass collection guards through a system.buckets prefix

   Published 2026-11-03

   Medium·CVSS 5.2 EPSS 0.17%

   MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an una...

5. CVE-2026-116641 The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

   Published 2026-10-28

   High·CVSS 7.6 EPSS 0.14%

   The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools...

6. CVE-2020-7924 Specific command line parameter might result in accepting invalid certificate

   Published 2021-04-12

   Medium·CVSS 6.5 EPSS 0.74%

   Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Too...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.