MediumFix available
pymongo — security advisory
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
- Products
- pymongo
- Affected versions
- 3.11.0-1, 3.11.0-1+deb12u1, 4.10.1-1, 4.10.1-2, 4.10.1-3, 4.10.1-4, 4.10.1-5, 4.10.1-6, 4.15.3-1, 4.15.3-2, 4.15.4-1, 4.15.4-2, 4.15.5-1, 4.16.0-1, 4.17.0-1, 4.18.1-1, 4.18.2-1, 4.7.3-1, 4.7.3-2
- Fixed versions
- 4.18.2-1
- CVEs
- CVE-2026-96747
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 06:34 UTC · Revision 1
Source evidence
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
osv:DEBIAN-CVE-2026-96747
pymongo
Fixed versions: Not specified
pymongo
Fixed versions: Not specified
pymongo
Fixed versions: 4.18.2-1
Complete source record
{
"id": "0e4e56ce31c15f117421f32118fe1cdbe14d9b48424cf0bc6a72ae6f48ec8d7c",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-96747",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-96747",
"summary": "The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.",
"evidence": "osv:DEBIAN-CVE-2026-96747",
"products": [
{
"name": {
"value": "pymongo",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.11.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.0-1+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "4.10.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.10.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "4.10.1-3",
"evidence": "/affected/0/versions"
},
{
"value": "4.10.1-4",
"evidence": "/affected/0/versions"
},
{
"value": "4.10.1-5",
"evidence": "/affected/0/versions"
},
{
"value": "4.10.1-6",
"evidence": "/affected/0/versions"
},
{
"value": "4.15.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.15.3-2",
"evidence": "/affected/0/versions"
},
{
"value": "4.15.4-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.15.4-2",
"evidence": "/affected/0/versions"
},
{
"value": "4.15.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.16.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.17.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.18.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.18.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.7.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.7.3-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "pymongo",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.10.1-6",
"evidence": "/affected/1/versions"
},
{
"value": "4.15.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.15.3-2",
"evidence": "/affected/1/versions"
},
{
"value": "4.15.4-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.15.4-2",
"evidence": "/affected/1/versions"
},
{
"value": "4.15.5-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.16.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.17.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.18.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.18.2-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "pymongo",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.18.2-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "4.10.1-6",
"evidence": "/affected/2/versions"
},
{
"value": "4.15.3-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.15.3-2",
"evidence": "/affected/2/versions"
},
{
"value": "4.15.4-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.15.4-2",
"evidence": "/affected/2/versions"
},
{
"value": "4.15.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.16.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.17.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.18.1-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2026-96747",
"aliases": [
"DEBIAN-CVE-2026-96747"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pymongo",
"purl": "pkg:deb/debian/pymongo?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.11.0-1",
"3.11.0-1+deb12u1",
"4.10.1-1",
"4.10.1-2",
"4.10.1-3",
"4.10.1-4",
"4.10.1-5",
"4.10.1-6",
"4.15.3-1",
"4.15.3-2",
"4.15.4-1",
"4.15.4-2",
"4.15.5-1",
"4.16.0-1",
"4.17.0-1",
"4.18.1-1",
"4.18.2-1",
"4.7.3-1",
"4.7.3-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-96747.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pymongo",
"purl": "pkg:deb/debian/pymongo?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"4.10.1-6",
"4.15.3-1",
"4.15.3-2",
"4.15.4-1",
"4.15.4-2",
"4.15.5-1",
"4.16.0-1",
"4.17.0-1",
"4.18.1-1",
"4.18.2-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-96747.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.2-1"
}
]
}
],
"package": {
"name": "pymongo",
"purl": "pkg:deb/debian/pymongo?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"4.10.1-6",
"4.15.3-1",
"4.15.3-2",
"4.15.4-1",
"4.15.4-2",
"4.15.5-1",
"4.16.0-1",
"4.17.0-1",
"4.18.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-96747.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-12T11:00:31.612151755Z",
"provider": "osv",
"upstream": [
"CVE-2026-96747"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-96747"
]
},
"related_cves": [
{
"value": "CVE-2026-96747",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 299767,
"published_at": "2026-09-24T19:17:20.65+00:00"
}