CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

• CWE-177

• https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
• https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
• https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96739A flaw has been found in SEMCMS up to 4.2. Affected by this …4.3
• CVE-2026-9674A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2026-96744Improper neutralization of special elements in data query lo…7.1
• CVE-2026-96745Deserialization of untrusted data in the command monitoring …5.6
• CVE-2026-96746An out-of-bounds write in the connection-monitoring logic of…6.5
• CVE-2026-96747The client-side field level encryption support in the MongoD…5
• CVE-2026-96749An integer overflow in the BSON document encoding component …8.4
• CVE-2026-9675Impact: The undici WebSocket client enforces maxPayloadSize …7.5
• CVE-2026-96750MongoDB Compass can interpolate a database name without esca…7.1
• CVE-2026-96751A vulnerability has been found in pmTicket Project-Managemen…7.3
• CVE-2026-96752The Zero Spam for WordPress plugin for WordPress is vulnerab…7.2
• CVE-2026-96754orval versions before 8.29.0 contain a code injection vulner…9.8