CVE-2026-88031
Description
A flaw was found in go.mongodb.org/mongo-driver for version < 1.17.10 and < 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.
Statement
A flaw was found in the MongoDB Go Driver. The GridFS component does not properly sanitize caller-supplied file identifiers before using them in database queries. A structured document passed as a file ID (for example, a BSON document containing query operators) is interpreted as a query condition rather than a literal match value. An authenticated attacker who can influence the file identifier passed to GridFS operations such as Delete, DownloadToStream, or OpenDownloadStream in an affected application can exploit this to delete all chunks in a GridFS bucket, resulting in permanent data loss and denial of service. The practical impact depends on whether the product's code passes externally-controlled values as GridFS file identifiers.
Mitigation
If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure:
- Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection.
- Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When input does not comply with the expected type, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities that would not be possible if the input conformed with the expected type.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
