# CVE-2026-119675: MongoDB Database Tools mongorestore privilege escalation via collection name bypass

Source: https://junglewise.ai/threats/cve-2026-119675-mongodb-database-tools-mongorestore-inconsistently-handles-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-119675 · Severity: high · CVSS 8.6 · Published 2026-11-03

MongoDB Database Tools' mongorestore utility fails to properly validate collection names in untrusted database dumps, allowing an attacker to bypass security filters. By crafting a malicious collection name, an attacker can create unauthorized database user accounts including those with administrative privileges during a restore operation. This requires an operator to restore untrusted data using privileged credentials, potentially leading to complete database compromise.

Technologies: [MongoDB Database Tools](https://junglewise.ai/threats/technologies/database-tools). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-119675 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119675 being exploited in the wild.

**How severe is CVE-2026-119675?** High severity, with a CVSS score of 8.6, published 3 November 2026.

**Which products and versions are affected?** MongoDB Database Tools 100.4.0 through 100.20.0.

**Is there a fix for CVE-2026-119675?** Yes: fixed in 100.20.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119675 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119675?** Check whether you run MongoDB Database Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 100.20.1

## Technical details

The mongorestore tool inconsistently validates the system.buckets. prefix when processing collection names, allowing specially crafted names to bypass namespace filters and special-collection guards. An unauthenticated attacker can exploit this by providing a malicious dump file; when restored by a privileged operator, unauthorized user accounts with elevated roles (including root) can be created. The vulnerability affects versions 100.4.0 through 100.20.0.

## Affected products

- MongoDB Database Tools 100.4.0 through 100.20.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md](https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md)

## Related threats

- [MongoDB Database Tools mongofiles path traversal in GridFS output](https://junglewise.ai/threats/cve-2026-119672-mongodb-database-tools-mongofiles-uses-a-database-stored-gridfs)
- [MongoDB DB Tools TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-116641-the-db-tools-rely-on-the-tls-implementation-in-golang-s-standard)