CVE-2026-96747: Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using PyMongo client-side field level encryption are exposed if an attacker can write to the encryption key metadata stored in the database. The issue affects connections initiated by the application host running the driver.
What must an attacker do to exploit it?
The attacker needs write access to encryption key metadata and must set a key management endpoint value that ends in ".sock". The driver can then interpret that value as a local Unix domain socket path and connect to it.
What data can be sent to the local socket?
The connection is limited to the start of a TLS handshake. The available information states that no attacker-chosen content is transmitted.