Connection String Parsing Vulnerability in PyMongo by MongoDB

CVE-2026-96748

What is CVE-2026-96748?

The PyMongo library exhibits a vulnerability due to improper handling of connection string parsing. Specifically, it decodes percent-encoded characters in the host portion prior to separating hosts based on delimiters. This can lead to scenarios where an application incorporates a hostname provided by an unauthenticated external actor, potentially allowing them to inject their own server addresses. Consequently, the application may interact with these malicious servers, risking exposure of authentication details and enabling possible delivery of tampered data in response to database queries.

References