CVE-2026-88031 GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

Medium 6.1 Published 10 Sep 2026 Updated 10 Sep 2026

An authenticated user can delete all GridFS file chunks by injecting query operators into file identifiers, causing data loss.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-88031?

CVE-2026-88031 is a medium-severity SQL injection vulnerability in MongoDB Go Driver, published on 10 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Weakness: CWE-943

Which versions are affected by CVE-2026-88031?

It affects 1 product.

Products include Mongodb Go Driver.

How do I fix CVE-2026-88031?

No fix has been published for CVE-2026-88031 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-88031 being exploited?

There is no known exploitation of CVE-2026-88031 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-88031, GHSA-gf3f-xg7m-h8wp, UBUNTU-CVE-2026-88031.