Vulnerability · Published Nov 3, 2026 · Assigned by mongodb
CVE-2026-119674mongorestore may restore encoded collection names into an unintended collection
Low 3.7
In plain English
A low-severity security flaw in Database Tools from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Database Tools | 100.0.2 – before 100.20.1 |
Weakness: CWE-174 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L