Description
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MongoDB | Python Driver | 1.6.0 – < 4.18.1 | 4.18.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pymongo | 4.18.1-1 | — |
| Debian 13 | pymongo | No fix yet | — |
| Debian 12 | pymongo | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pymongo | No fix yet | — |
| Ubuntu 26.04 LTS | pymongo | No fix yet | — |
| Ubuntu 24.04 LTS | pymongo | No fix yet | — |
| Ubuntu 22.04 LTS | pymongo | No fix yet | — |
| Ubuntu 20.04 LTS | pymongo | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | pymongo | No fix yet | — |
| Ubuntu Pro 18.04 LTS | pymongo | No fix yet | — |
| Ubuntu Pro 16.04 LTS | pymongo | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | python-PyMySQL +1 | 0.10.1-2.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | python-distro +1 | 1.4.0-2.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | python-docs +1 | 3.6.7-2.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | python-docutils +1 | 0.14-12.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | python-nose +2 | 1.3.7-31.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | python-pygments +1 | 2.2.0-22.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | python-sqlalchemy +2 | 1.3.2-3.module+el8.10.0+20981+3704b446 | RHSA-2026:82858 |
| RHEL 8 | python-virtualenv +2 | 15.1.0-23.module+el8.10.0+22619+61b70790 | RHSA-2026:82858 |
| RHEL 8 | python-wheel +2 | 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | python3-bson +4 | 3.7.0-3.module+el8.10.0+25000+2cc6bf61 | RHSA-2026:82858 |
| RHEL 8 | python36 +3 | 3.6.8-39.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
| RHEL 8 | scipy +1 | 1.0.0-21.module+el8.10.0+20784+edafcd43 | RHSA-2026:82858 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.8 TUS | python-PyMySQL +1 | 0.10.1-2.module+el8.4.0+9657+a4b6a102 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-distro +1 | 1.4.0-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-docs +1 | 3.6.7-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-docutils +1 | 0.14-12.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-nose +2 | 1.3.7-31.module+el8.5.0+12207+5c5719bc | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-pygments +1 | 2.2.0-22.module+el8.5.0+10789+e4939b94 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-sqlalchemy +2 | 1.3.2-2.module+el8.8.0+20977+39d98680.1 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-virtualenv +2 | 15.1.0-22.module+el8.8.0+22625+4a966c0c.1 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python-wheel +2 | 1:0.31.1-3.module+el8.5.0+12207+5c5719bc | RHSA-2026:95578 |
| RHEL 8.8 TUS | python3-bson +4 | 3.7.0-2.module+el8.8.0+25061+ffd72774 | RHSA-2026:95578 |
| RHEL 8.8 TUS | python36 +3 | 3.6.8-38.module+el8.5.0+12207+5c5719bc | RHSA-2026:95578 |
| RHEL 8.8 TUS | scipy +1 | 1.0.0-21.module+el8.5.0+10916+41bd434d | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-PyMySQL +1 | 0.10.1-2.module+el8.4.0+9657+a4b6a102 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-distro +1 | 1.4.0-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-docs +1 | 3.6.7-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-docutils +1 | 0.14-12.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-nose +2 | 1.3.7-31.module+el8.5.0+12207+5c5719bc | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-pygments +1 | 2.2.0-22.module+el8.5.0+10789+e4939b94 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-sqlalchemy +2 | 1.3.2-2.module+el8.8.0+20977+39d98680.1 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-virtualenv +2 | 15.1.0-22.module+el8.8.0+22625+4a966c0c.1 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python-wheel +2 | 1:0.31.1-3.module+el8.5.0+12207+5c5719bc | RHSA-2026:95578 |
| RHEL 8.8 E4S | python3-bson +4 | 3.7.0-2.module+el8.8.0+25061+ffd72774 | RHSA-2026:95578 |
| RHEL 8.8 E4S | python36 +3 | 3.6.8-38.module+el8.5.0+12207+5c5719bc | RHSA-2026:95578 |
| RHEL 8.8 E4S | scipy +1 | 1.0.0-21.module+el8.5.0+10916+41bd434d | RHSA-2026:95578 |
| RHEL 8.6 EUS Long Life | python-PyMySQL +1 | 0.10.1-2.module+el8.4.0+9657+a4b6a102 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-distro +1 | 1.4.0-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-docs +1 | 3.6.7-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-docutils +1 | 0.14-12.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-nose +2 | 1.3.7-31.module+el8.5.0+12207+5c5719bc | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-pygments +1 | 2.2.0-22.module+el8.5.0+10789+e4939b94 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-sqlalchemy +2 | 1.3.2-2.module+el8.6.0+20978+2ad18ee0.1 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-virtualenv +2 | 15.1.0-21.module+el8.6.0+22648+901a012d.2 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python-wheel +2 | 1:0.31.1-3.module+el8.5.0+12207+5c5719bc | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python3-bson +4 | 3.7.0-2.module+el8.6.0+25063+cbc52f04 | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | python36 +3 | 3.6.8-38.module+el8.5.0+12207+5c5719bc | RHSA-2026:95580 |
| RHEL 8.6 EUS Long Life | scipy +1 | 1.0.0-21.module+el8.5.0+10916+41bd434d | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-PyMySQL +1 | 0.10.1-2.module+el8.4.0+9657+a4b6a102 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-distro +1 | 1.4.0-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-docs +1 | 3.6.7-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-docutils +1 | 0.14-12.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-nose +2 | 1.3.7-31.module+el8.5.0+12207+5c5719bc | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-pygments +1 | 2.2.0-22.module+el8.5.0+10789+e4939b94 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-sqlalchemy +2 | 1.3.2-2.module+el8.6.0+20978+2ad18ee0.1 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-virtualenv +2 | 15.1.0-21.module+el8.6.0+22648+901a012d.2 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python-wheel +2 | 1:0.31.1-3.module+el8.5.0+12207+5c5719bc | RHSA-2026:95580 |
| RHEL 8.6 AUS | python3-bson +4 | 3.7.0-2.module+el8.6.0+25063+cbc52f04 | RHSA-2026:95580 |
| RHEL 8.6 AUS | python36 +3 | 3.6.8-38.module+el8.5.0+12207+5c5719bc | RHSA-2026:95580 |
| RHEL 8.6 AUS | scipy +1 | 1.0.0-21.module+el8.5.0+10916+41bd434d | RHSA-2026:95580 |
| RHEL 8.4 EUS Long Life | python-PyMySQL +1 | 0.10.1-2.module+el8.4.0+9657+a4b6a102 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-distro +1 | 1.4.0-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-docs +1 | 3.6.7-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-docutils +1 | 0.14-12.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-nose +2 | 1.3.7-30.module+el8.4.0+15040+36b018e7.1 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-pygments +1 | 2.2.0-20.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-sqlalchemy +2 | 1.3.2-2.module+el8.4.0+20979+8ba06d83.1 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-virtualenv +2 | 15.1.0-19.module+el8.4.0+22650+01781d50.3 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python-wheel +2 | 1:0.31.1-2.module+el8.4.0+15040+36b018e7.1 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python3-bson +4 | 3.7.0-1.module+el8.4.0+25066+5933e152.1 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | python36 +3 | 3.6.8-2.module+el8.4.0+15040+36b018e7.1 | RHSA-2026:95583 |
| RHEL 8.4 EUS Long Life | scipy +1 | 1.0.0-20.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-PyMySQL +1 | 0.10.1-2.module+el8.4.0+9657+a4b6a102 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-distro +1 | 1.4.0-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-docs +1 | 3.6.7-2.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-docutils +1 | 0.14-12.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-nose +2 | 1.3.7-30.module+el8.4.0+15040+36b018e7.1 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-pygments +1 | 2.2.0-20.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-sqlalchemy +2 | 1.3.2-2.module+el8.4.0+20979+8ba06d83.1 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-virtualenv +2 | 15.1.0-19.module+el8.4.0+22650+01781d50.3 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python-wheel +2 | 1:0.31.1-2.module+el8.4.0+15040+36b018e7.1 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python3-bson +4 | 3.7.0-1.module+el8.4.0+25066+5933e152.1 | RHSA-2026:95583 |
| RHEL 8.4 AUS | python36 +3 | 3.6.8-2.module+el8.4.0+15040+36b018e7.1 | RHSA-2026:95583 |
| RHEL 8.4 AUS | scipy +1 | 1.0.0-20.module+el8.1.0+3334+5cb623d7 | RHSA-2026:95583 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | python3-PyMySQL | 0.10.1-2.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python3-bson +3 | 3.7.0-3.module_el8.10.0+4300+ca04280a | ALSA-2026:82858 |
| AlmaLinux 8 | python3-distro | 1.4.0-2.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python3-docs | 3.6.7-2.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python3-docutils | 0.14-12.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python3-nose +1 | 1.3.7-31.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python3-pygments | 2.2.0-22.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python3-scipy | 1.0.0-21.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python3-sqlalchemy +1 | 1.3.2-3.module_el8.10.0+3769+3838165b | ALSA-2026:82858 |
| AlmaLinux 8 | python3-virtualenv +1 | 15.1.0-23.module_el8.10.0+3937+b6a3652f | ALSA-2026:82858 |
| AlmaLinux 8 | python3-wheel +1 | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | ALSA-2026:82858 |
| AlmaLinux 8 | python36 +3 | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2026:82858 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | python-PyMySQL | 0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2026:82858 |
| Rocky Linux 8 | python-distro | 1.4.0-2.module+el8.10.0+1592+61442852 | RLSA-2026:82858 |
| Rocky Linux 8 | python-docs | 3.6.7-2.module+el8.10.0+1592+61442852 | RLSA-2026:82858 |
| Rocky Linux 8 | python-docutils | 0.14-12.module+el8.9.0+1531+a18208f5 | RLSA-2026:82858 |
| Rocky Linux 8 | python-nose | 1.3.7-31.module+el8.9.0+1531+a18208f5 | RLSA-2026:82858 |
| Rocky Linux 8 | python-pygments | 2.2.0-22.module+el8.9.0+1531+a18208f5 | RLSA-2026:82858 |
| Rocky Linux 8 | python-sqlalchemy | 1.3.2-3.module+el8.10.0+1602+b47e27fa | RLSA-2026:82858 |
| Rocky Linux 8 | python-virtualenv | 15.1.0-23.module+el8.10.0+1910+234ad790 | RLSA-2026:82858 |
| Rocky Linux 8 | python-wheel | 1:0.31.1-3.module+el8.9.0+1531+a18208f5 | RLSA-2026:82858 |
| Rocky Linux 8 | python36 | 3.6.8-39.module+el8.10.0+1592+61442852 | RLSA-2026:82858 |
| Rocky Linux 8 | scipy | 1.0.0-21.module+el8.10.0+1592+61442852 | RLSA-2026:82858 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-pymongo | 4.18.1-1.1 | openSUSE-SU-2026:11808-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-bson +3 | 3.10.1-5.amzn2023.0.4 | ALAS2023-2026-3121 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | python3-PyMySQL | 0.10.1-2.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-bson +3 | 3.7.0-3.module+el8.10.0+91063+60d69350 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-distro | 1.4.0-2.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-docs | 3.6.7-2.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-docutils | 0.14-12.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-nose +1 | 1.3.7-31.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-pygments | 2.2.0-22.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-scipy | 1.0.0-21.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-sqlalchemy +1 | 1.3.2-3.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-virtualenv +1 | 15.1.0-23.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python3-wheel +1 | 1:0.31.1-3.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
| Oracle Linux 8 | python36 +3 | 3.6.8-39.module+el8.10.0+90473+c30184f9 | ELSA-2026-82858 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | datadog-agent-7.77-core-integrations +3 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.81-core-integrations | 7.81.3-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pymongo | < 4.18.1 | 4.18.1 | GHSA-8fvv-fgr5-f8ch |
Advisories 10
- RHSA-2026:95578 Red Hat Security Advisory: python36:3.6 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95580 Red Hat Security Advisory: python36:3.6 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95583 Red Hat Security Advisory: python36:3.6 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3320 MongoDB: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:82858 Important: python36:3.6 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:82858 Red Hat Security Advisory: python36:3.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:82858 Important: python36:3.6 security update Rocky Linux Security Advisories · Oct 15, 2026
- ELSA-2026-82858 Important: python36:3.6 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
- ALAS2023-2026-3121 Important: python-pymongo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- openSUSE-SU-2026:11808-1 python313-pymongo-4.18.1-1.1 on GA media SUSE / openSUSE Security Updates · Sep 18, 2026