Incorrect URL Decoding in MongoDB Database Tools Leading to Data Handling Issues
CVE-2026-119674

2.1LOW

Key Information:

Vendor

Mongodb
Status
Database Tools
Vendor
CVE Published:
3 November 2026

What is CVE-2026-119674?

A vulnerability exists in MongoDB Database Tools where the mongorestore function improperly URL-decodes collection names retrieved from metadata after the corresponding dump filename has been truncated. This can lead to a database user crafting specific encoded collection names to manipulate where the restore operation writes documents, potentially overwriting or omitting backed-up data. When an authorized user attempts to restore a collection, they could inadvertently interact with an unintended target collection unless proper precautions are taken, especially when using the --drop option. It is crucial for operators to verify collection names during restores to avoid data integrity issues.

Affected Version(s)

Database Tools 100.0.2 < 100.20.1

References

https://github.com/mongodb/mongo-tools/blob/master/CHANGE...

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.