CERT-FR advisory CERTFR-2026-AVI-1462: multiple MongoDB driver and tooling flaws allow remote code execution, DoS and data disclosure
CERT-FR published advisory CERTFR-2026-AVI-1462 on 5 November 2026 relaying several MongoDB security bulletins dated 3 November 2026 that cover multiple vulnerabilities in MongoDB client-side components, not in the database server itself. The flaws may lead to remote arbitrary code execution, remote denial of service, disclosure or alteration of data and a security policy bypass. Affected components are the MongoDB C Driver before 1.30.15 and before 2.5.8, the Rust driver before 3.10.0, the MongoDB Entity Framework provider before 9.0.5 and 10.0.5, the ODBC driver before 3.0.1 and the Database Tools before 100.20.1. CERT-FR references the MongoDB JIRA issues CDRIVER-6420, CDRIVER-6494, CDRIVER-6501, CDRIVER-6508, CDRIVER-6521, EF-478 and RUST-2525, the SQL interface changelog and the mongo-tools CHANGELOG, together with eleven CVE identifiers including CVE-2026-120952, CVE-2026-120953, CVE-2026-120959, CVE-2026-19502, CVE-2026-76794, CVE-2026-76797, CVE-2026-76798 and CVE-2025-11575, as well as older Go ecosystem issues (CVE-2022-30636, CVE-2024-45337, CVE-2025-22874) carried through dependencies of the Database Tools. The advisory reports no exploitation in the wild and gives no CVSS scores or per-CVE mapping.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1462 groups several flaws in MongoDB client-side components, not in the database server. The impacts listed are remote code execution, remote denial of service, loss of data confidentiality and integrity, and security policy bypass. The CVEs are CVE-2026-120952, CVE-2026-120953, CVE-2026-120959, CVE-2026-19502, CVE-2026-76794, CVE-2026-76797, CVE-2026-76798 and CVE-2025-11575. The advisory gives no CVSS scores and does not say which CVE maps to which impact or component. Affected: C Driver before 1.30.15 and 2.5.8, Rust Driver before 3.10.0, Entity Framework provider before 9.0.5 and 10.0.5, ODBC Driver before 3.0.1, Database Tools before 100.20.1. Those versions are the fixed ones. CVE-2022-30636, CVE-2024-45337 and CVE-2025-22874 are older Go issues carried through Database Tools dependencies.
Como funciona
The advisory is a summary and does not describe how any individual flaw works. The story only says the exposure is on the client side. Exploitation would generally need an application using a vulnerable driver to process attacker-influenced data or to connect to an attacker-controlled or compromised server. At which step each component fails is not stated in the sources.
Por que é vulnerável
The sources do not give root causes for the new MongoDB flaws. The presence of long-known Go CVEs suggests that part of the Database Tools update is dependency upgrades, not new defects in MongoDB code. This is the story's reading, not something the advisory confirms. The fixes are the vendor releases listed above.
Onde está
The advisory points to MongoDB JIRA issues CDRIVER-6420, CDRIVER-6494, CDRIVER-6501, CDRIVER-6508, CDRIVER-6521, EF-478 and RUST-2525, plus the SQL interface changelog and the mongo-tools CHANGELOG.md. No file or function is named.
Como foi descoberta
CERT-FR published the advisory on 5 November 2026, relaying MongoDB security bulletins dated 3 November 2026. The sources do not say who found the flaws or how. The advisory reports no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:31.
Detalhes técnicos
The advisory is a summary bulletin and does not describe the individual defects. The impacts it enumerates — remote code execution, remote denial of service, loss of data confidentiality and integrity and security policy bypass — are aggregated across all referenced components; the exposure is on the client side, so exploitation generally requires an application using a vulnerable driver to process attacker-influenced data or connect to an attacker-controlled or compromised server. The presence of long-known Go CVEs among the references is consistent with dependency updates shipped in the Database Tools changelog rather than new defects in MongoDB code.
Remediação
Upgrade to C Driver 1.30.15 / 2.5.8, Rust driver 3.10.0, Entity Framework provider 9.0.5 / 10.0.5, ODBC driver 3.0.1 and Database Tools 100.20.1, then rebuild and redeploy every application statically linking or vendoring these drivers, since client libraries are not patched by updating the database server.
Linha do tempo
-
CERT-FR advisory CERTFR-2026-AVI-1462: multiple MongoDB driver and tooling flaws allow remote code execution, DoS and data disclosure
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1462 on 5 November 2026 relaying several MongoDB security bulletins dated 3 November 2026 that cover multiple vulnerabilities in MongoDB client-side components, not in the database server itself. The flaws may lead to remote arbitrary code execution, remote denial of service, disclosure or alteration of data and a security policy bypass. Affected components are the MongoDB C Driver before 1.30.15 and before 2.5.8, the Rust driver before 3.10.0, the MongoDB Entity Framework provider before 9.0.5 and 10.0.5, the ODBC driver before 3.0.1 and the Database Tools before 100.20.1. CERT-FR references the MongoDB JIRA issues CDRIVER-6420, CDRIVER-6494, CDRIVER-6501, CDRIVER-6508, CDRIVER-6521, EF-478 and RUST-2525, the SQL interface changelog and the mongo-tools CHANGELOG, together with eleven CVE identifiers including CVE-2026-120952, CVE-2026-120953, CVE-2026-120959, CVE-2026-19502, CVE-2026-76794, CVE-2026-76797, CVE-2026-76798 and CVE-2025-11575, as well as older Go ecosystem issues (CVE-2022-30636, CVE-2024-45337, CVE-2025-22874) carried through dependencies of the Database Tools. The advisory reports no exploitation in the wild and gives no CVSS scores or per-CVE mapping.
Technical Details
The advisory is a summary bulletin and does not describe the individual defects. The impacts it enumerates — remote code execution, remote denial of service, loss of data confidentiality and integrity and security policy bypass — are aggregated across all referenced components; the exposure is on the client side, so exploitation generally requires an application using a vulnerable driver to process attacker-influenced data or connect to an attacker-controlled or compromised server. The presence of long-known Go CVEs among the references is consistent with dependency updates shipped in the Database Tools changelog rather than new defects in MongoDB code.
Remediation
Upgrade to C Driver 1.30.15 / 2.5.8, Rust driver 3.10.0, Entity Framework provider 9.0.5 / 10.0.5, ODBC driver 3.0.1 and Database Tools 100.20.1, then rebuild and redeploy every application statically linking or vendoring these drivers, since client libraries are not patched by updating the database server.