Quick answers
- Is CVE-2026-88033 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-88033 being exploited in the wild.
- How severe is CVE-2026-88033?
- High severity, with a CVSS score of 8.3, published 10 September 2026.
- Which products and versions are affected?
- MongoDB Java Driver before 5.11.1.
- Is there a fix for CVE-2026-88033?
- A patch was published on 2026-09-10: Fix released in version 5.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-88033 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-88033?
- Check whether you run MongoDB Java Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a query injection flaw in the GridFS component of the MongoDB Java Driver, where user-supplied file identifiers are not properly neutralized before being used in database query logic. Instead of matching file identifiers as literal values, the driver interprets them as query conditions (e.g., operators like $eq, $ne), allowing an authenticated attacker to construct malicious identifiers to bypass intended file access controls. The attack requires an application to pass attacker-controlled data as a file identifier to GridFS operations (delete, read, rename). An attacker can leverage this to read unauthorized files, delete entire buckets of GridFS chunks, or rename arbitrary files. The fix, available in version 5.11.1, implements explicit $eq matching for all user-supplied GridFS file IDs in database commands.
Affected products
- MongoDB Java Driver before 5.11.1
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fix released in version 5.11.1