CVE-2026-119674: low-severity vulnerability in MongoDB Database Tools
mongorestore may restore encoded collection names into an unintended collection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.1epss 0.2%
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
MongoDB · Database ToolsRelated CVEs — MongoDB Database Tools
In the same product, most dangerous first.
CVE-2026-119672MEDIUMmongofiles may disclose GridFS content to standard output through a stored filenameEPSS 0.2%CVE-2026-119675MEDIUMmongorestore may bypass collection guards through a system.buckets prefixEPSS 0.2%CVE-2026-119673LOWmongofiles may write outside the working directory through a symlinkEPSS 0.1%CVE-2026-116641HIGHThe DB Tools trust certificates issued by recoverable eMudhra intermediate CAsEPSS 0.1%