← Vulnerability feed

Vulnerability record · CVE-2026-88033 · published 10 September 2026

CVE-2026-88033: Mongodb java driver vulnerability

Mongodb · Java Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

6.1 CVSS 4.0 Medium EPSS 0.46% · top 63.0% CWE-943 · CWE-943
6.1CVSS 4.0 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
16 Sep 2026Last modified by NVD

Description

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jira.mongodb.org/browse/JAVA-6283 Vendor AdvisoryIssue Tracking

Track CVE-2026-88033 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2026-88032Mongodb java driver use after free vulnerabilityA use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected…EPSS 0.26%8.2CVE-2026-18710Mongodb java driver sensitive information in log file vulnerabilityA MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to applica…EPSS 0.15%6.8CVE-2021-20328Mongodb java driver improper certificate validation vulnerabilitySpecific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KM…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2026-88033), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.