What is CVE-2026-119675?

CVE-2026-119675 is a high-severity security flaw affecting MongoDB Database Tools mongorestore, carrying a CVSS score of 8.6. The issue stems from an inconsistent handling of the system.buckets. prefix when validating collection names in an untrusted dump. This security advisory resembles other authorization bypass issues similar to CVE-2026-58946: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios, where inadequate checks lead to severe permission escalations.

Specifically, a specially crafted collection name can bypass special-collection guards and operator namespace filters. This unexpected behavior causes a restore operation to create an unauthorized user-chosen database account, including accounts endowed with the root role.

Who is affected by this vulnerability?

This vulnerability affects MongoDB Database Tools versions 100.4.0 through versions strictly before 100.20.1. Successful exploitation requires an operator to restore unauthorized user-controlled data using credentials that possess sufficient user-management privileges on the destination deployment.

It is important to note that merely excluding the admin namespace alone does not prevent this behavior. For context on privilege elevation issues in software components, administrators can review related flaws like CVE-2026-58957: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios and CVE-2026-59044: Vulnerabilidad Use-After-Free con CVSS 8.4.

How do I protect my environment?

Mitigating CVE-2026-119675 requires immediate action from database administrators handling untrusted data dumps. You should avoid processing database backups from unverified or untrusted external sources until patches are fully applied across your tooling infrastructure.

Consult the CVE-2026-59044: Vulnerabilidad Use-After-Free con CVSS 8.4 advisory parallels to understand the importance of strict input validation. Follow the steps below to secure your environment:

  1. Identify all servers and developer workstations running vulnerable MongoDB Database Tools versions 100.4.0 up to 100.20.0.
  2. Upgrade MongoDB Database Tools to version 100.20.1 or later using your package manager or by downloading the release from the official repository.
  3. Verify the installed tool version by running mongorestore --version in your command line.
  4. Review the official [[https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md|Referencia técnica en github.com]] to confirm the patch notes.