CVE-2026-96747: PyMongo Unix Domain Socket Vulnerability in Client-Side Field Level Encryption
Summary
CVE-2026-96747: PyMongo passed the KMS endpoint of a data key verbatim into parse_host(), which returns any string ending in .sock unchanged instead of validating it as a hostname and port. Affects pymongo versions >= 3.9.0, < 4.18.2. Fixed in 4.18.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyMongo is a popular Python driver for MongoDB, enabling developers to interact with MongoDB databases using Python code. It supports various features including client-side field level encryption (CSFLE) and Queryable Encryption, which enhance data security by allowing sensitive fields to be encrypted before being sent to the database. However, a recent vulnerability has been identified that can compromise the security of applications using these features.
Vulnerability Detail
The vulnerability arises from PyMongo's handling of the KMS (Key Management Service) endpoint, where it allows a string ending in '.sock' to be passed without validation. This leads to the potential for an attacker with write access to the key vault to redirect KMS connections to arbitrary Unix domain socket paths on the application host. Although the connection is wrapped in a TLS context, the attacker can control the connection target, posing a risk to the application's security. The issue is particularly concerning for applications utilizing CSFLE or Queryable Encryption, as it could lead to unauthorized access or manipulation of sensitive data.
How To Fix
Latest published version: 4.19.0 as of 22 Oct 2026
pip install --upgrade "pymongo==4.19.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.18.2
This is the first release that contains the fix.
pip install --upgrade "pymongo==4.18.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider the following workarounds: 1. Restrict write access to the key vault collection to trusted principals only. 2. Validate the masterKey.endpoint on data keys you create and audit existing key vault documents for endpoints ending in '.sock'.
Conclusion
The vulnerability identified as CVE-2026-96747 in PyMongo poses a risk to applications using client-side field level encryption due to improper handling of KMS endpoints. It is crucial for developers to upgrade to the patched version or implement workarounds to mitigate potential security risks.
See every vulnerability recorded for pymongo →
FAQ
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
Applications using PyMongo with client-side field level encryption (CSFLE) or Queryable Encryption are affected if an attacker can write to the key vault collection.
An attacker could redirect KMS connections to a Unix domain socket of their choice, potentially compromising sensitive data, although the transmitted bytes are still secured by TLS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup at Vulert Scanner.
If your application does not utilize CSFLE or Queryable Encryption, it is not affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pymongo.
