MongoDB Fixes Seven Driver Flaws, Including Rogue Server Attacks

MongoDB has issued advisories covering seven vulnerabilities across its official drivers and related tools. The issues include five rated high severity and two medium severity; the highest listed rating is 8.4 for CVE-2026-96749. No active exploitation or public proof-of-concept code has been confirmed, according to the supplied report.

The flaws affect several components. CVE-2026-96748 allows crafted, percent-encoded connection-string hostnames to redirect connections to rogue database servers, potentially exposing authentication handshakes and queries. CVE-2026-96749 is a signed integer overflow in PyMongo’s native BSON encoder that can cause a heap out-of-bounds write when unusually large data is processed.

Other issues include a heap buffer overflow in C Driver topology monitoring (CVE-2026-96746), PHP object injection through command-monitoring events (CVE-2026-96745), and shell-script injection in MongoDB Compass’s embedded shell (CVE-2026-96750). Additional vulnerabilities affect Laravel integration and client-side field encryption.

Administrators and developers should update affected components. PyMongo should be upgraded to 4.18.2 or later; the C Driver to 1.30.12 or 2.5.5; the PHP Driver to 1.21.10, 2.1.10 or 2.5.3; MongoDB Compass to 1.49.12; and Laravel MongoDB to 5.11.0. The report directs users to MongoDB’s security alerts for complete update instructions.