Insecure Collection Name Handling in MongoDB Database Tools

CVE-2026-119675

What is CVE-2026-119675?

The MongoDB Database Tools, specifically the mongorestore utility, inconsistently validate collection names prefixed with system.buckets. This flaw allows attackers to bypass necessary security checks, leading to the unauthorized creation of database accounts, including those with administrative privileges. Successful exploitation occurs when operators restore data using compromised credentials that possess user-management capabilities. Merely excluding the admin namespace does not mitigate this issue, making it critical for users to ensure they are operating on secure and updated versions of the tools.

References