CVE-2026-119674 mongorestore may restore encoded collection names into an unintended collection
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119674?
CVE-2026-119674 is a low-severity vulnerability in MongoDB Database Tools, published on 3 Nov 2026.
Official description
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.
Weakness: CWE-174
Which versions are affected by CVE-2026-119674?
How do I fix CVE-2026-119674?
No fix has been published for CVE-2026-119674 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119674 being exploited?
There is no known exploitation of CVE-2026-119674 in the wild and no public exploit code.
Sources
Also known as GHSA-px68-pqg4-8q7x, UBUNTU-CVE-2026-119674.