Server-Side Request Forgery (SSRF) in mongo-python-driver - CVE-2026-96747
Published: September 24, 2026
Vulnerability identifier: #VU151937
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-96747
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to initiate a connection to an arbitrary Unix domain socket.
The vulnerability exists due to improper input validation in the _EncryptionIO.kms_request KMS endpoint handling when processing a .sock-suffixed KMS endpoint from a key vault document. A remote user can set masterKey.endpoint on a data key to an attacker-chosen socket path to initiate a connection to an arbitrary Unix domain socket.
Only applications using client-side field level encryption or Queryable Encryption with a key vault writable by untrusted parties are affected. The connection is wrapped in a verifying TLS context, so the TLS handshake fails and no KMS message is sent.
Affected software
mongo-python-driver
How to mitigate CVE-2026-96747
Install security update from vendor's website.
mongo-python-driver - update to 4.18.2