MongoDB Database Tools EUVD-2026-116026

Three concrete prerequisites must all hold: (1) an operator must restore an untrusted, attacker-controlled dump via mongorestore; (2) that restore must use credentials carrying user-management privileges on the destination deployment (otherwise the unauthorized account cannot be created); and (3) the tool must be a vulnerable version, 100.4.0 through any release before 100.20.1. The trigger is a crafted collection name exploiting inconsistent handling of the 'system.buckets.' prefix. Critical limiting/defeating factors: the attacker needs no privileges themselves but cannot act alone - a privileged operator action (user interaction) is required, and the data source must be untrusted. The description explicitly warns that excluding the admin namespace alone does NOT prevent the behavior, so that common hardening step is insufficient. The attack is local to the restore operation (not remotely reachable), which substantially narrows realistic exposure.

The signals point to a real but conditional, mid-tier issue rather than a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P, score 5.2 Medium) describes a local attack that requires a specific attack condition (AT:P) and passive user interaction (UI:P) - i.e. a privileged operator must restore attacker-supplied data. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with that moderate profile. There is no CISA KEV listing and no EPSS score in the input, so exploitation status is 'no public exploit identified at time of analysis' and real-world exploitation probability cannot be quantified from the data provided. The notable tension is impact versus reachability: the subsequent-system impact is maximal (SC:H/SI:H/SA:H - creation of a root-role database account fully compromises the destination deployment), yet the vulnerable-system metrics are all N and the preconditions are significant (local restore of untrusted data by an operator wielding user-management credentials). This is therefore a high-impact, low-likelihood, precondition-gated flaw rather than a widely-sprayable network exploit. Missing data to flag explicitly: no EPSS, no KEV, and no independent PoC - urgency rests on the vendor's own disclosure and the 'this_month' label, not on observed exploitation.

An attacker prepares a malicious MongoDB dump containing a collection whose name abuses the 'system.buckets.' prefix so it slips past mongorestore's special-collection and operator namespace filters. A database operator, believing the dump is benign, restores it using credentials that hold user-management privileges on the destination deployment; the inconsistent name validation then causes an attacker-chosen account - potentially with the root role - to be created. No public exploit was identified in the input, and the attack depends on socially engineering a privileged operator into restoring untrusted data.