CVE-2026-96748: Connection redirection via percent-encoded delimiter injection in connection string hosts
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed when they insert a hostname supplied by an unauthenticated party into a PyMongo connection string. The issue depends on that untrusted value being placed in the host portion of the URI.
What does an attacker need to do to exploit it?
An attacker needs to provide a hostname value that includes percent-encoded connection-string delimiters. Because decoding occurs before the host list is split, this can add attacker-chosen servers to the client's connection targets.
What could an attacker gain or change?
The application may send its authentication exchange and database operations to an attacker-chosen server. That server can observe limited information and return altered results.