MongoDB Database Tools: mongorestore privilege escalation (CVE-2026-119675)

CVE-2026-119675 concerns an input validation flaw in MongoDB Database Tools versions 100.4.0 through 100.20.0. The mongorestore utility inconsistently handles the 'system.buckets.' prefix when validating collection names in untrusted database dumps. By exploiting this, an attacker can bypass namespace guards and restore user-controlled data into unauthorized namespaces. If the operator executing the restore process possesses user-management privileges on the destination database, this vulnerability can be leveraged to create unauthorized database accounts, including those with root roles. Notably, filtering the 'admin' namespace is insufficient to mitigate this risk.

Impact

Successful exploitation allows for the creation of unauthorized database users with elevated privileges, including root access, within the target MongoDB deployment. This requires the victim operator to execute a restore operation from a malicious or compromised dump file while using credentials that permit user management.

Recommendation

• Patch the MongoDB Database Tools to version 100.20.1 or later on all administrative workstations and CI/CD pipelines used for database maintenance.
• Audit and restrict the permissions of database service accounts used for restore operations; ensure that users performing restore tasks do not hold excessive user-management privileges (e.g., 'userAdmin' or 'userAdminAnyDatabase') unless strictly necessary.
• Avoid restoring database dumps from untrusted or unverified third-party sources.