CVE-2026-119675 mongorestore may bypass collection guards through a system.buckets prefix
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119675?
CVE-2026-119675 is a medium-severity vulnerability in MongoDB Database Tools, published on 3 Nov 2026.
Official description
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.
Weakness: CWE-706
Which versions are affected by CVE-2026-119675?
How do I fix CVE-2026-119675?
No fix has been published for CVE-2026-119675 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119675 being exploited?
There is no known exploitation of CVE-2026-119675 in the wild and no public exploit code.
Sources
Also known as GHSA-fg58-w2p8-9j7f, UBUNTU-CVE-2026-119675.