Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-88029

Опубликовано: 10 сент. 2026
Источник: redhat
CVSS3: 8.3
EPSS Низкий

Описание

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

A flaw was found in the MongoDB Python Driver's GridFS component. Improper handling of special characters in file identifiers allows an authenticated user to inject query operators. This can lead to unauthorized access to stored file content, potentially disclosing sensitive information. Additionally, an attacker could delete all GridFS file chunks, resulting in a denial of service by rendering stored files unreadable.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat OpenShift AI (RHOAI)rhoai/odh-llama-stack-core-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-ogx-core-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9Affected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-94
https://bugzilla.redhat.com/show_bug.cgi?id=2531586pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection

EPSS

Процентиль: 18%
0.00259
Низкий

8.3 High

CVSS3

Связанные уязвимости

CVSS3: 8.3
ubuntu
2 дня назад

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

CVSS3: 8.3
nvd
5 дней назад

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

CVSS3: 8.3
debian
5 дней назад

Improper neutralization of special elements in data query logic in the ...

CVSS3: 8.3
github
5 дней назад

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

EPSS

Процентиль: 18%
0.00259
Низкий

8.3 High

CVSS3