Vulnerability · Published Nov 3, 2026 · Assigned by mongodb
CVE-2026-119675mongorestore may bypass collection guards through a system.buckets prefix
High 8.6
In plain English
A high-severity security flaw in Database Tools from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Database Tools | 100.4.0 – before 100.20.1 |
Weakness: CWE-706 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H