{"id":"CVE-2026-119675","title":"mongorestore may bypass collection guards through a system.buckets prefix","summary":"MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace …","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-706"],"vendor":"MongoDB","product":"Database Tools","affected":["database_tools >= 100.4.0 < 100.20.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T17:45:26.007147Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T17:45:37.053Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119675","references":[{"url":"https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"}],"tags":["cve.org"],"epss":0.00174,"epssPercentile":0.06896,"ingestedAt":"2026-11-05T20:33:06.331Z","slug":"CVE-2026-119675","body":"## Overview\n\nMongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.\n\n## Affected\n\n- `database_tools >= 100.4.0 < 100.20.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}