{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mongodb-database-tools--100.20.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongodb:database_tools:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-119675"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MongoDB Database Tools (\u003c 100.20.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MongoDB"],"content_html":"\u003cp\u003eCVE-2026-119675 concerns an input validation flaw in MongoDB Database Tools versions 100.4.0 through 100.20.0. The mongorestore utility inconsistently handles the 'system.buckets.' prefix when validating collection names in untrusted database dumps. By exploiting this, an attacker can bypass namespace guards and restore user-controlled data into unauthorized namespaces. If the operator executing the restore process possesses user-management privileges on the destination database, this vulnerability can be leveraged to create unauthorized database accounts, including those with root roles. Notably, filtering the 'admin' namespace is insufficient to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the creation of unauthorized database users with elevated privileges, including root access, within the target MongoDB deployment. This requires the victim operator to execute a restore operation from a malicious or compromised dump file while using credentials that permit user management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the MongoDB Database Tools to version 100.20.1 or later on all administrative workstations and CI/CD pipelines used for database maintenance.\u003c/li\u003e\n\u003cli\u003eAudit and restrict the permissions of database service accounts used for restore operations; ensure that users performing restore tasks do not hold excessive user-management privileges (e.g., 'userAdmin' or 'userAdminAnyDatabase') unless strictly necessary.\u003c/li\u003e\n\u003cli\u003eAvoid restoring database dumps from untrusted or unverified third-party sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T18:05:37Z","date_published":"2026-11-03T18:05:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-mongorestore-auth-bypass/","summary":"A vulnerability in the mongorestore utility allows an attacker to bypass namespace validation by leveraging crafted system.buckets collection names, potentially resulting in unauthorized administrative account creation when run by a privileged operator.","title":"MongoDB Database Tools: mongorestore privilege escalation (CVE-2026-119675)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-mongorestore-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - MongoDB Database Tools (\u003c 100.20.1)","version":"https://jsonfeed.org/version/1.1"}