CVE-2026-88031
highImproper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file id…
Vendor / product: Mongodb — go driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
CVSS
8.1
8.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Severity source: NVD CVSS v3.1 (cna@mongodb.com)
Timeline (UTC)
Published: 2026-09-10 18:18
Modified: 2026-09-29 15:58
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:52 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
mongodb / go_driver ≥1.0.0 <1.17.10, ≥2.0.0 <2.9.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://jira.mongodb.org/browse/GODRIVER-4081
References
- https://jira.mongodb.org/browse/GODRIVER-4081 cna@mongodb.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:52 UTC · record ↗