MongoDB Database Tools 100.0.2<100.20.1 MONGORESTORE URLDecode Collection Name Vulnerability
CVE-2026-119674 Published on November 3, 2026

mongorestore may restore encoded collection names into an unintended collection
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.

NVD

Vulnerability Analysis

CVE-2026-119674 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
PASSIVE

Weakness Type

Double Decoding of the Same Data

The software decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.


Affected Versions

MongoDB Database Tools: