Quick answers
- Is CVE-2026-88024 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-88024 being exploited in the wild.
- How severe is CVE-2026-88024?
- High severity, with a CVSS score of 8.3, published 10 September 2026.
- Which products and versions are affected?
- MongoDB Rust Driver before 3.9.1.
- Is there a fix for CVE-2026-88024?
- A patch was published on 2026-09-11: Fix released in MongoDB Rust Driver 3.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-88024 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-88024?
- Check whether you run MongoDB Rust Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper neutralization of special elements in data query logic (query injection) within the GridFS component of the MongoDB Rust Driver. When processing file identifiers, the driver fails to use strict equality matching (the $eq operator), allowing caller-supplied identifiers to be interpreted as MongoDB query conditions. An authenticated user who can influence the file identifier passed by an affected application can execute unintended database operations, including reading file content beyond the intended target or deleting all GridFS file chunks in the affected bucket. The fix, released in version 3.9.1, wraps all user-supplied GridFS file IDs with explicit $eq operators to enforce literal matching.
Affected products
- MongoDB Rust Driver before 3.9.1
Timeline
- 2026-09-10: disclosed: CVE-2026-88024 published
- 2026-09-11: patched: Fix released in MongoDB Rust Driver 3.9.1