CVE-2026-96748: Connection redirection via percent-encoded delimiter injection in connection string hosts
Summary
PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.
Impact
An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because %2C and %3A survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.
Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.
Patches
Fixed in PyMongo 4.18.2. Percent-decoding was moved into splithosts and now applies only to Unix domain socket paths, identified by an unescaped .sock suffix before decoding, and only after splitting on ,.
Workarounds
Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.
Details
The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where unquoteplus was applied to the whole host section in validateuri and, later, parsesrv, before the string was split on , and :.
Other sources
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pymongoto a version that resolves this vulnerability.Fixed in 4.18.2 - Upgrade
Upgrade
PyMongoto a version that resolves this vulnerability.Fixed in 4.18.2 - Compensating control
Do not interpolate untrusted input into the host portion of a MongoDB connection string; if unavoidable, reject the input or percent-decode and validate it before building the URI.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed when they insert a hostname supplied by an unauthenticated party into a PyMongo connection string. The issue depends on that untrusted value being placed in the host portion of the URI.
What does an attacker need to do to exploit it?
An attacker needs to provide a hostname value that includes percent-encoded connection-string delimiters. Because decoding occurs before the host list is split, this can add attacker-chosen servers to the client's connection targets.
What could an attacker gain or change?
The application may send its authentication exchange and database operations to an attacker-chosen server. That server can observe limited information and return altered results.