# CVE-2026-88031: MongoDB Go Driver improper neutralization in GridFS delete

Source: https://junglewise.ai/threats/cve-2026-88031-mongodb-go-driver-improper-neutralization-in-gridfs-delete  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88031 · Severity: high · CVSS 8.1 · Published 2026-09-10

MongoDB's Go Driver includes a GridFS component for storing and retrieving large files. A flaw in the file deletion logic allows file identifiers supplied by applications to be misinterpreted as database query filters instead of literal values. An authenticated user who can control the file identifier could cause all file chunks in a GridFS bucket to be deleted, making stored files unreadable and unavailable to legitimate users.

Technologies: [MongoDB Go Driver](https://junglewise.ai/threats/technologies/go-driver). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-88031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88031 being exploited in the wild.

**How severe is CVE-2026-88031?** High severity, with a CVSS score of 8.1, published 10 September 2026.

**Which products and versions are affected?** MongoDB Go Driver before 1.17.10 and 2.9.1.

**Is there a fix for CVE-2026-88031?** A patch was published on 2026-09-09: Fix resolved Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88031 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88031?** Check whether you run MongoDB Go Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper neutralization (CWE-93) in the GridFS component's delete methods, where user-supplied file identifiers are not properly escaped as literal values before being used in database query conditions. An authenticated attacker who can influence the file ID parameter passed to GridFS delete operations can craft a malicious identifier that is interpreted as a MongoDB query operator (e.g., a conditional expression) rather than a literal file identifier. This allows deletion of unintended file chunks, potentially removing all chunks in the affected bucket. The fix, released in Go Driver versions 1.17.10 and 2.9.1, explicitly uses the $eq operator to enforce literal matching of file identifiers. No public exploits are known at the time of publication.

## Affected products

- MongoDB Go Driver before 1.17.10 and 2.9.1

## Timeline

- 2026-08-11: other: Issue created
- 2026-09-09: patched: Fix resolved
- 2026-09-10: disclosed: CVE-2026-88031 published

## References

- [https://jira.mongodb.org/browse/GODRIVER-4081](https://jira.mongodb.org/browse/GODRIVER-4081)

## Related threats

- [MongoDB Go Driver BSON array validation out-of-bounds](https://junglewise.ai/threats/cve-2026-107325-improper-validation-of-a-bson-array-length-in-the-mongodb-go)
- [MongoDB Go Driver integer overflow in BSON handling](https://junglewise.ai/threats/cve-2026-107324-an-integer-overflow-in-bson-value-length-handling-in-the-mongodb)
- [MongoDB Go Driver namespace injection in BulkWrite](https://junglewise.ai/threats/cve-2026-81521-mongodb-go-driver-namespace-injection-in-bulkwrite)
- [MongoDB mongo-go-driver heap out-of-bounds read in GSSAPI error handling](https://junglewise.ai/threats/cve-2026-2303-mongodb-mongo-go-driver-heap-out-of-bounds-read-in-gssapi-error)