MongoDB Database Tools (< 100.20.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mongodb-database-tools--100.20.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 18:05:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoDB Database Tools: mongorestore privilege escalation (CVE-2026-119675)https://feed.craftedsignal.io/briefs/2026-11-mongodb-mongorestore-auth-bypass/Tue, 03 Nov 2026 18:05:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongodb-mongorestore-auth-bypass/A vulnerability in the mongorestore utility allows an attacker to bypass namespace validation by leveraging crafted system.buckets collection names, potentially resulting in unauthorized administrative account creation when run by a privileged operator.CVE-2026-119675 concerns an input validation flaw in MongoDB Database Tools versions 100.4.0 through 100.20.0. The mongorestore utility inconsistently handles the 'system.buckets.' prefix when validating collection names in untrusted database dumps. By exploiting this, an attacker can bypass namespace guards and restore user-controlled data into unauthorized namespaces. If the operator executing the restore process possesses user-management privileges on the destination database, this vulnerability can be leveraged to create unauthorized database accounts, including those with root roles. Notably, filtering the 'admin' namespace is insufficient to mitigate this risk.

Impact

Successful exploitation allows for the creation of unauthorized database users with elevated privileges, including root access, within the target MongoDB deployment. This requires the victim operator to execute a restore operation from a malicious or compromised dump file while using credentials that permit user management.

Recommendation

  • Patch the MongoDB Database Tools to version 100.20.1 or later on all administrative workstations and CI/CD pipelines used for database maintenance.
  • Audit and restrict the permissions of database service accounts used for restore operations; ensure that users performing restore tasks do not hold excessive user-management privileges (e.g., 'userAdmin' or 'userAdminAnyDatabase') unless strictly necessary.
  • Avoid restoring database dumps from untrusted or unverified third-party sources.
]]>highadvisory