Vulnerability · Published Sep 24, 2026 · Assigned by mongodb
CVE-2026-96747Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
Medium 5.0
In plain English
A medium-severity server-side request forgery in Python Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pymongo | no fix listed | DEBIAN-CVE-2026-96747 |
| Debian:13 | pymongo | no fix listed | DEBIAN-CVE-2026-96747 |
| Debian:14 | pymongo | 4.18.2-1 | DEBIAN-CVE-2026-96747 |
| PyPI | pymongo | 4.18.2 | GHSA-qx36-8mw2-4r3x |
| PyPI | pymongo | 4.18.2 | PYSEC-2026-4295 |
| Ubuntu:22.04:LTS | pymongo | no fix listed | UBUNTU-CVE-2026-96747 |
| Ubuntu:24.04:LTS | pymongo | no fix listed | UBUNTU-CVE-2026-96747 |
| Ubuntu:26.04:LTS | pymongo | no fix listed | UBUNTU-CVE-2026-96747 |
| Ubuntu:26.10 | pymongo | no fix listed | UBUNTU-CVE-2026-96747 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Python Driver | 3.9.0 – before 4.18.2 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N