CVE-2026-96747: PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
PyMongo passed the KMS endpoint of a data key verbatim into parse_host(), which returns any string ending in .sock unchanged instead of validating it as a hostname and port. The driver’s connection code then treats such an address as a Unix domain socket path and connects to it with AF_UNIX. Because the endpoint originates from masterKey.endpoint in a key vault document, a party who can write to the key vault could redirect the driver’s KMS connection to an arbitrary Unix domain socket path on the application host.
References
- github.com/advisories/GHSA-qx36-8mw2-4r3x
- github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
- github.com/mongodb/mongo-python-driver/commit/44119d0f9dfa0224d84b03be702a6d9a5ef1dea7
- github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7
- github.com/mongodb/mongo-python-driver/pull/3066
- github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x
- nvd.nist.gov/vuln/detail/CVE-2026-96747
- www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732
Code Behaviors & Features
Detect and mitigate CVE-2026-96747 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →