CVE-2026-96748

Name of the Vulnerable Software and Affected Versions PyMongo (affected versions not specified)

Description Connection string parsing decodes percent-encoded characters in the host portion before the host list is separated by its delimiters. If an application incorporates a hostname provided by an unauthenticated party into a connection string, that party can inject additional servers into the database client. This allows the application to send authentication exchanges and database operations to an attacker-controlled server, which can then observe limited information and return altered results.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.