Skip to content
Fencer Vulns
high 8.1

CVE-2026-88031 json

GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

published 2026-09-10 59 d ago modified 2026-09-29 41 d ago also EUVD-2026-75667

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Patch / fix

  • MongoDB Go Driver 1.17.10, 2.9.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-88031 updated cvss 8.1

go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9, assisted/agent-preinstall-image-builder-rhel9 Red Hat Compliance Operator compliance/openshift-compliance-must-gather-rhel8 Red Hat ExternalDNS Operator edo/external-dns-rhel8, edo/external-dns-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9
    affected: workaround, no fix available
  • Red Hat MCP Server for Red Hat OpenShift openshift-mcp-tech-preview/openshift-mcp-server-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-log-reader-rhel8, rhmtc/openshift-migration-must-gather-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-vsphere-copy-offload-populator-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/capoa-bootstrap-rhel9, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-installer-rhel9, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/capoa-control-plane-rhel9, +8 more Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift API for Data Protection oadp/oadp-velero-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-agentic-sandbox-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines-client 1.22.0-11814.el9, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-chains-controller-rhel8, openshift-pipelines/pipelines-chains-controller-rhel9 Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/power-monitoring-rhel9-operator
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/submariner-rhel9-operator, rhacm2/multicluster-observability-rhel9-operator Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/ee-supported-rhel9, ansible-automation-platform-27/ee-supported-rhel9, ansible-automation-platform-25/aap-must-gather-rhel8, ansible-automation-platform-27/ansible-devspaces-rhel9, ansible-automation-platform-tech-preview/ansible-devspaces-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhceph/snmp-notifier-rhel8, rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/snmp-notifier-rhel9, rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 rhceph/grafana-rhel9, rhceph/snmp-notifier-rhel9, rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 8 rhceph/snmp-notifier-rhel9, rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 9 rhceph/alloy-rhel10, rhceph/grafana-rhel10, rhceph/snmp-notifier-rhel10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Certification Program for Red Hat Enterprise Linux 9 rhcertification/redhat-certification-baremetal
    affected: workaround, no fix available
show 12 more
  • Red Hat Developer Hub 1 rhdh/rhdh-must-gather-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Edge Manager 1 flightctl 0.10.0-1.el9em Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json, osbuild-composer 134.1-10.el10_0 Red Hat Enterprise Linux 9 image-builder, rhel9/grafana, rhel9-eus/rhel-9.6-bootc, image-builder 52.1-1.el10_2.2 Red Hat Enterprise Linux 10 rhel10/grafana, rhel10-eus/rhel-10.0-bootc, image-builder 52.1-1.el10_2.2, osbuild-composer 134.1-10.el10_0
    affected: workaround, no fix available
  • Red Hat Hardened Images prometheus3.5 3.5.5-0.8.hum1, opentofu1.11 1.11.14-0.1.hum1
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-ml-pipelines-driver-rhel9, rhoai/odh-ml-pipelines-launcher-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-ml-pipelines-api-server-v2-rhel9, rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9, rhoai/odh-ai-gateway-payload-processing-e2e-rhel9, +1 more
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 cri-o, openshift-kni/commatrix, openshift4/ose-etcd-rhel9, openshift4/cnf-tests-rhel8, openshift4/network-tools-rhel8, openshift4/network-tools-rhel9, +25 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift-kni/commatrix, openshift5/ose-cluster-capi-rhel9-operator, openshift5/ose-machine-config-rhel9-operator, openshift5/ose-cluster-ingress-rhel9-operator, openshift5/ose-agent-installer-node-agent-rhel9, openshift5/ose-nutanix-machine-controllers-rhel9, +2 more Red Hat Openshift Data Foundation 4 odf4/odf-must-gather-rhel9, odf4/ocs-metrics-exporter-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps microshift-gitops 1.19.2-36.el9, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/must-gather-rhel9, openshift-gitops-argocd-cli 1.19.2-36.el9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-must-gather-rhel9 Red Hat Service Interconnect 2 service-interconnect/skupper-controller-rhel9
    affected: workaround, no fix available
  • Red Hat Trusted Artifact Signer rhtas/gitsign-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Web Terminal web-terminal/web-terminal-tooling-rhel9 Red Hat Security Profiles Operator compliance/openshift-security-profiles-rhel8-operator, compliance/openshift-security-profiles-operator-bundle
    affected: workaround, no fix available
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9, zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9, zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-api-rhel9, migration-toolkit-virtualization/mtv-ova-proxy-rhel9, migration-toolkit-virtualization/mtv-controller-rhel9, migration-toolkit-virtualization/mtv-ova-provider-server-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/discovery-rhel9
    under investigation

2 more under investigation, 12 more fixed, 40 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
59 d ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA 4.0 6.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • MongoDB Go Driver

Classification

Weakness
  • CWE-943 Improper Neutralization of Special Elements in Data Query Logic

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.