Vulnerability-Lookup

RHSA-2026:90314

Vulnerability from csaf_redhat - Published: 2026-10-26 14:11 - Updated: 2026-10-30 00:55

Summary

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 RHEL 10 Container Release.

Severity

Important

Notes

Topic: Red Hat OpenShift Dev Spaces 3.31.0 RHEL 10 containers have been released.

Details: Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.31 release is based on Eclipse Che 7.123.x and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-88031

A flaw was found in go.mongodb.org/mongo-driver for version < 1.17.10 and < 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE-1287 - Improper Validation of Specified Type of Input

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

11 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:90314	self
https://access.redhat.com/documentation/en-us/red…	external
https://access.redhat.com/security/cve/CVE-2026-88031	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-88031	self
https://bugzilla.redhat.com/show_bug.cgi?id=2531587	external
https://www.cve.org/CVERecord?id=CVE-2026-88031	external
https://nvd.nist.gov/vuln/detail/CVE-2026-88031	external
https://jira.mongodb.org/browse/GODRIVER-4081	external
https://www.mongodb.com/community/forums/t/mongod…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Dev Spaces 3.31.0 RHEL 10 containers have been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a  browser-based IDE built for teams and organizations. Dev Spaces runs in  OpenShift and is well-suited for container-based development. \nThe 3.31 release is based on Eclipse Che 7.123.x and uses the DevWorkspace engine  to provide support for workspaces based on devfile v2.1 and v2.2. \nUsers still using the v1 standard should migrate as soon as possible. \nhttps://devfile.io/docs/2.2.0/migrating-to-devfile-v2 \nDev Spaces supports OpenShift EUS releases v4.16 and higher. Users are  expected to update to supported OpenShift releases in order to continue to get Dev  Spaces updates. \nhttps://access.redhat.com/support/policy/updates/openshift#crw",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:90314",
        "url": "https://access.redhat.com/errata/RHSA-2026:90314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.31/html/administration_guide/installing-devspaces",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.31/html/administration_guide/installing-devspaces"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88031",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88031"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90314.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 RHEL 10 Container Release.",
    "tracking": {
      "current_release_date": "2026-10-30T00:55:31+00:00",
      "generator": {
        "date": "2026-10-30T00:55:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:90314",
      "initial_release_date": "2026-10-26T14:11:49+00:00",
      "revision_history": [
        {
          "date": "2026-10-26T14:11:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-26T14:11:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T00:55:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Dev Spaces 3.31",
                "product": {
                  "name": "Red Hat OpenShift Dev Spaces 3.31",
                  "product_id": "Red Hat OpenShift Dev Spaces 3.31",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_devspaces:3.31::el10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Dev Spaces"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
                "product": {
                  "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
                  "product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/udi-base-rhel10@sha256%3A9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1792615273"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64",
                "product": {
                  "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64",
                  "product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/udi-base-rhel10@sha256%3Ad0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1792615273"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
                "product": {
                  "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
                  "product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/udi-base-rhel10@sha256%3A9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1792615273"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
                "product": {
                  "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
                  "product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/udi-base-rhel10@sha256%3Aa7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1792615273"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31",
          "product_id": "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64"
        },
        "product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.31"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31",
          "product_id": "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le"
        },
        "product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.31"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x as a component of Red Hat OpenShift Dev Spaces 3.31",
          "product_id": "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x"
        },
        "product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.31"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31",
          "product_id": "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64"
        },
        "product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.31"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-88031",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-09-10T18:11:27.321656+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531587"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in go.mongodb.org/mongo-driver for version \u003c 1.17.10 and \u003c 2.9.1. \nImproper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the MongoDB Go Driver. The GridFS component does not properly sanitize caller-supplied file identifiers before using them in database queries. A structured document passed as a file ID (for example, a BSON document containing query operators) is interpreted as a query condition rather than a literal match value. An authenticated attacker who can influence the file identifier passed to GridFS operations such as Delete, DownloadToStream, or OpenDownloadStream in an affected application can exploit this to delete all chunks in a GridFS bucket, resulting in permanent data loss and denial of service.\nThe practical impact depends on whether the product\u0027s code passes externally-controlled values as GridFS file identifiers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
          "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
          "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
          "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531587",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531587"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "https://jira.mongodb.org/browse/GODRIVER-4081",
          "url": "https://jira.mongodb.org/browse/GODRIVER-4081"
        },
        {
          "category": "external",
          "summary": "https://www.mongodb.com/community/forums/t/mongodb-go-driver-1-17-10-released/343342",
          "url": "https://www.mongodb.com/community/forums/t/mongodb-go-driver-1-17-10-released/343342"
        }
      ],
      "release_date": "2026-09-10T17:59:35.845000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T14:11:49+00:00",
          "details": "Before applying this update, make sure all previously released errata  relevant to your system have been applied. \nFor details on how to apply this update, refer to: \nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90314"
        },
        {
          "category": "workaround",
          "details": "If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure:\n- Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection.\n- Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).",
          "product_ids": [
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x",
            "Red Hat OpenShift Dev Spaces 3.31:registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs"
    }
  ]
}

CVE-2026-88031 (GCVE-0-2026-88031)

Vulnerability from cvelistv5 – Published: 2026-09-10 17:59 – Updated: 2026-09-10 18:25

Title

GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

Summary

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 18:25 UTC

CWE

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Assigner

mongodb CNA under the mitre root

CNA scorecard C 70/100 over 221 records in the last 180 days details

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/GODRIVER-4081

Impacted products

1 product

Vendor	Product	Version
MongoDB	Go Driver	Affected: 1.0.0 , < 1.17.10 (semver) Affected: 2.0.0 , < 2.9.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T18:25:51.598529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T18:25:57.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Go Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.17.10",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.9.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable."
            }
          ],
          "value": "Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T17:59:35.845Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/GODRIVER-4081"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-88031",
    "datePublished": "2026-09-10T17:59:35.845Z",
    "dateReserved": "2026-09-09T19:49:39.183Z",
    "dateUpdated": "2026-09-10T18:25:57.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted