BREW-MONGO-ORCHESTRATION… (GHSA-QX36-8MW2-4R3X)

Vulnerability from osv_homebrew – Published: 2026-10-06 05:01 – Updated: 2026-10-06 05:01 – Source website
VLAI
Summary
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
Details

Summary

PyMongo passed the KMS endpoint of a data key verbatim into parse_host(), which returns any string ending in .sock unchanged instead of validating it as a hostname and port. The driver's connection code then treats such an address as a Unix domain socket path and connects to it with AF_UNIX. Because the endpoint originates from masterKey.endpoint in a key vault document, a party who can write to the key vault could redirect the driver's KMS connection to an arbitrary Unix domain socket path on the application host.

Impact

An application using client-side field level encryption (CSFLE) or Queryable Encryption is affected if an attacker can write to its key vault collection. Setting masterKey.endpoint on a data key to a .sock-suffixed string causes the next KMS request for that key (key cache TTL is ~60 seconds) to open an AF_UNIX connection to the attacker-chosen filesystem path from inside the victim application process. The documented custom KMS endpoint feature supports TCP hosts only, so this crosses a boundary the feature was never intended to allow.

Impact is limited to the side effects of the connection itself. The socket is still wrapped in a verifying TLS context using the .sock string as server_hostname, and insecure KMS TLS options are rejected, so the handshake always fails and the KMS message is never sent. The attacker controls the connect target but not the transmitted bytes (a fixed TLS ClientHello).

Applications that do not use CSFLE or Queryable Encryption are not affected. Applications whose key vault is not writable by untrusted parties are not affected.

Patches

Fixed in PyMongo 4.18.2 _EncryptionIO.kms_request now rejects a .sock-suffixed KMS endpoint with pymongo.errors.ConfigurationError immediately after parsing, before any connection is attempted, on both the synchronous and asynchronous paths. No application code changes are required beyond upgrading.

Workarounds

If you cannot upgrade immediately:

  • Restrict write access to the key vault collection to trusted principals only. This is the recommended configuration regardless of this issue.
  • Validate masterKey.endpoint on data keys you create, and audit existing key vault documents for endpoints ending in .sock.

Details

  • _EncryptionIO.fetch_keys reads key vault documents from the server and hands them to libmongocrypt, which surfaces the stored masterKey.endpoint verbatim as kms_context.endpoint.
  • _EncryptionIO.kms_request passed that string to parse_host(endpoint, 443). parse_host returns entities ending in .sock verbatim, skipping the hostname and port validation applied to every other input.
  • _create_connection (and the async equivalent) checks host.endswith(".sock") and performs an AF_UNIX sock.connect(host), treating the string as a filesystem path.
Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "pymongo",
        "resource_purl": "pkg:pypi/pymongo@4.18.2",
        "upstream_fixed_in": "4.18.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "mongo-orchestration",
        "purl": "pkg:brew/mongo-orchestration"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.0"
            },
            {
              "fixed": "0.11.2_4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/pymongo@4.18.2",
        "name": "pymongo",
        "resource": "pymongo",
        "strategy": "registry",
        "subject_version": "4.18.2"
      }
    ]
  },
  "details": "### Summary\n\nPyMongo passed the KMS endpoint of a data key verbatim into `parse_host()`, which returns any string ending in `.sock` unchanged instead of validating it as a hostname and port. The driver\u0027s connection code then treats such an address as a Unix domain socket path and connects to it with `AF_UNIX`. Because the endpoint originates from `masterKey.endpoint` in a key vault document, a party who can write to the key vault could redirect the driver\u0027s KMS connection to an arbitrary Unix domain socket path on the application host.\n\n### Impact\n\nAn application using client-side field level encryption (CSFLE) or Queryable Encryption is affected if an attacker can write to its key vault collection. Setting `masterKey.endpoint` on a data key to a `.sock`-suffixed string causes the next KMS request for that key (key cache TTL is ~60 seconds) to open an `AF_UNIX` connection to the attacker-chosen filesystem path from inside the victim application process. The documented custom KMS endpoint feature supports TCP hosts only, so this crosses a boundary the feature was never intended to allow.\n\nImpact is limited to the side effects of the connection itself. The socket is still wrapped in a verifying TLS context using the `.sock` string as `server_hostname`, and insecure KMS TLS options are rejected, so the handshake always fails and the KMS message is never sent. The attacker controls the connect target but not the transmitted bytes (a fixed TLS ClientHello).\n\nApplications that do not use CSFLE or Queryable Encryption are not affected. Applications whose key vault is not writable by untrusted parties are not affected.\n\n### Patches\n\nFixed in PyMongo 4.18.2 `_EncryptionIO.kms_request` now rejects a `.sock`-suffixed KMS endpoint with `pymongo.errors.ConfigurationError` immediately after parsing, before any connection is attempted, on both the synchronous and asynchronous paths. No application code changes are required beyond upgrading.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Restrict write access to the key vault collection to trusted principals only. This is the recommended configuration regardless of this issue.\n- Validate `masterKey.endpoint` on data keys you create, and audit existing key vault documents for endpoints ending in `.sock`.\n\n### Details\n\n- `_EncryptionIO.fetch_keys` reads key vault documents from the server and hands them to libmongocrypt, which surfaces the stored `masterKey.endpoint` verbatim as `kms_context.endpoint`.\n- `_EncryptionIO.kms_request` passed that string to `parse_host(endpoint, 443)`. `parse_host` returns entities ending in `.sock` verbatim, skipping the hostname and port validation applied to every other input.\n- `_create_connection` (and the async equivalent) checks `host.endswith(\".sock\")` and performs an `AF_UNIX` `sock.connect(host)`, treating the string as a filesystem path.",
  "id": "BREW-mongo-orchestration-CVE-2026-96747",
  "modified": "2026-10-06T05:01:25Z",
  "published": "2026-10-06T05:01:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96747"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/pull/3066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/commit/44119d0f9dfa0224d84b03be702a6d9a5ef1dea7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mongodb/mongo-python-driver"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
    },
    {
      "type": "WEB",
      "url": "https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption",
  "upstream": [
    "GHSA-qx36-8mw2-4r3x",
    "CVE-2026-96747"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.