CVE-2026-96750
Last modified
CVE-2026-96750 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges.
Description
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Compass | >= 1.44.0, < 1.49.12 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-96750?
How severe is CVE-2026-96750?
How do I fix CVE-2026-96750?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-96745Deserialization of untrusted data in the command monitoring …5.6
- CVE-2026-96746An out-of-bounds write in the connection-monitoring logic of…6.5
- CVE-2026-96747The client-side field level encryption support in the MongoD…5
- CVE-2026-96748PyMongo's connection string parsing decodes percent-encoded …6.5
- CVE-2026-96749An integer overflow in the BSON document encoding component …8.4
- CVE-2026-9675Impact: The undici WebSocket client enforces maxPayloadSize …7.5
- CVE-2026-96751A vulnerability has been found in pmTicket Project-Managemen…7.3
- CVE-2026-96752The Zero Spam for WordPress plugin for WordPress is vulnerab…7.2
- CVE-2026-96754orval versions before 8.29.0 contain a code injection vulner…9.8
- CVE-2026-96755orval versions 8.14.0 through 8.28.1 contain a code injectio…9.8
- CVE-2026-96756orval versions before 8.30.0 contain a code injection vulner…8.1
- CVE-2026-96757orval before 8.29.0 fails to escape OpenAPI media-type keys …9.8
Are you affected by CVE-2026-96750?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST