CVE-2026-119675
8.6 HIGHpublic exploit availablePublished 2026-11-03 · Updated 2026-11-03
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-706
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-106181
- MEDIUMCVE-2026-106230
- HIGHCVE-2026-106274
- HIGHCVE-2026-106279
- HIGHCVE-2026-106308
- MEDIUMCVE-2026-106325
- HIGHCVE-2026-106409
- MEDIUMCVE-2026-107822PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.