Data Query Vulnerability in MongoDB C++ Driver Affects GridFS Component
CVE-2026-88034

6.1MEDIUM

Key Information:

Vendor

Mongodb
Status
C++ Driver
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88034?

The MongoDB C++ Driver's GridFS component is susceptible to a flaw that arises from the improper neutralization of special elements in data query logic. This vulnerability allows an authenticated user, who can influence the structured file identifier passed by an application, to manipulate it such that it is misinterpreted as a query condition. Consequently, the user may gain unauthorized access to stored file content or initiate the removal of GridFS file chunks in the affected bucket, leading to loss of data and making the stored file content unreadable.

Affected Version(s)

C++ Driver 3.2.0 < 4.5.3

References

https://jira.mongodb.org/browse/CXX-3556

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.