Client-Side Encryption Vulnerability in MongoDB Python Driver

CVE-2026-96747

What is CVE-2026-96747?

The MongoDB Python Driver exhibits a security flaw in its client-side field level encryption feature. When a key management endpoint ends with '.sock', it is misinterpreted as a local Unix domain socket path instead of a remote host. This behavior allows users with write access to the encryption key metadata stored in the database to manipulate the application into establishing connections with local sockets on the host, potentially exposing sensitive data. Importantly, any transmitted data is restricted to the initial stage of a TLS handshake, preventing the delivery of chosen content.

References