GHSA-VP6J-J7W5-5XJJ
Vulnerability from github – Published: 2026-10-05 23:47 – Updated: 2026-10-05 23:47Summary
PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.
Impact
An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because %2C and %3A survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.
Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.
Patches
Fixed in PyMongo 4.18.2. Percent-decoding was moved into split_hosts and now applies only to Unix domain socket paths, identified by an unescaped .sock suffix before decoding, and only after splitting on ,.
Workarounds
Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.
Details
The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where unquote_plus was applied to the whole host section in _validate_uri and, later, _parse_srv, before the string was split on , and :.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.18.1"
},
"package": {
"ecosystem": "PyPI",
"name": "pymongo"
},
"ranges": [
{
"events": [
{
"introduced": "3.5.0"
},
{
"fixed": "4.18.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-96748"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T23:47:07Z",
"nvd_published_at": "2026-09-24T19:17:20Z",
"severity": "HIGH"
},
"details": "### Summary\n\nPyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client\u0027s seed list.\n\n### Impact\n\nAn application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo\u0027s parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker\u0027s host, exposing credentials, or route operations to it.\n\nUnix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.\n\n### Patches\n\nFixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.\n\n### Workarounds\n\nDo not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.\n\n### Details\n\nThe decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where `unquote_plus` was applied to the whole host section in `_validate_uri` and, later, `_parse_srv`, before the string was split on `,` and `:`.",
"id": "GHSA-vp6j-j7w5-5xjj",
"modified": "2026-10-05T23:47:07Z",
"published": "2026-10-05T23:47:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96748"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/pull/3066"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7"
},
{
"type": "PACKAGE",
"url": "https://github.com/mongodb/mongo-python-driver"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
},
{
"type": "WEB",
"url": "https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.