CVE-2026-96748: PyMongo Host Injection Vulnerability via Percent-Encoding
Summary
CVE-2026-96748: PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters. Affects pymongo versions >= 3.5.0, < 4.18.2. Fixed in 4.18.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyMongo is a widely used Python driver for MongoDB, enabling applications to interact with MongoDB databases seamlessly. It provides features such as connection pooling, automatic reconnection, and support for various MongoDB operations. However, a vulnerability exists in its connection string parsing mechanism, which can lead to security risks if untrusted input is interpolated into connection strings.
Vulnerability Detail
The vulnerability arises from PyMongo's handling of percent-encoded characters in the host section of connection strings. Specifically, the library percent-decodes the entire host section before splitting it into individual host:port entries. This means that an attacker can craft a hostname with percent-encoded delimiters (like %2C for commas and %3A for colons), which will be decoded into actual delimiters, allowing the injection of additional, attacker-controlled hosts into the client's seed list. This can lead to unauthorized access and potential credential exposure as the client may attempt to connect to these malicious hosts.
How To Fix
Latest published version: 4.19.0 as of 22 Oct 2026
pip install --upgrade "pymongo==4.19.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.18.2
This is the first release that contains the fix.
pip install --upgrade "pymongo==4.18.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, avoid interpolating untrusted input into the host portion of the connection string. If it is unavoidable, ensure to validate and percent-decode the value before constructing the URI. For example, you can use the following code snippet to validate the input:
import urllib.parse
def validate_host(host):
# Decode the host and check for valid characters
decoded_host = urllib.parse.unquote(host)
if any(char in decoded_host for char in [',', ':']):
raise ValueError('Invalid host input')
return decoded_host
Conclusion
The CVE-2026-96748 vulnerability in PyMongo poses a significant risk if untrusted input is used in connection strings. It is crucial to update to the patched version 4.18.2 or later and implement input validation to mitigate potential security threats.
See every vulnerability recorded for pymongo →
FAQ
CVE-2026-96748 is a security vulnerability in PyMongo that allows host injection through improperly handled percent-encoded characters in connection strings.
If your application uses untrusted input in MongoDB connection strings, an attacker could inject malicious hosts, leading to unauthorized access and potential data exposure.
Versions of PyMongo from 3.5.0 up to 4.18.1 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to use the Vulert playground without signup.
If an immediate update is not feasible, ensure that you do not use untrusted input in the host section of your connection strings and validate any input before use.
References
Related vulnerabilities
Recent vulnerabilities recorded for pymongo.
