The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The client-side field level encryption support in the MongoDB Python Driver can treat a key management
    endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with
    write access to the encryption key metadata stored in the database can cause an application using the
    driver to open connections to local sockets on the application host. Data sent over these connections is
    limited to the start of a TLS handshake, so no chosen content is transmitted. (CVE-2026-96747)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22003-1 advisory.

    Changes in python-pymongo:

    - CVE-2026-96749: integer overflow in BSON document encoding allows an       unprivileged user to write outside the bounds of an allocated buffer       (bsc#1282845)
    - CVE-2026-96748: host injection in connection string leading to       database connection redirection due to improper connection string       parsing (bsc#1282827)
    - CVE-2026-96747: improper handling of key management endpoint values       ending in `.sock` allows users with write access to the encryption       key metadata to open connections to local sockets on the application       host (bsc#1282844)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4398-1 advisory.

    - CVE-2026-96747: improper handling of key management endpoint values ending in `.sock` allows users with     write access       to the encryption key metadata to open connections to local sockets on the application host     (bsc#1282844).
    - CVE-2026-96748: host injection in connection string leading to database connection redirection due to     improper       connection string parsing (bsc#1282827).
    - CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside     the bounds of       an allocated buffer (bsc#1282845).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The client-side field level encryption support in the MongoDB Python Driver can treat a key management     endpoint value ending in .sock as a local Unix domain socket path rather than a remote host. A user with     write access to the encryption key metadata stored in the database can cause an application using the     driver to open connections to local sockets on the application host. Data sent over these connections is     limited to the start of a TLS handshake, so no chosen content is transmitted. (CVE-2026-96747)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473571	Echo: pymongo: security update to 4.18.2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473571	Echo: pymongo: security update to 4.18.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473482	Chainguard: multiple localstack packages: security update to 4.14.0-r29	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473482	Chainguard: multiple localstack packages: security update to 4.14.0-r29	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
473002	SCA: security update for pymongo (GHSA-qx36-8mw2-4r3x)	Tenable Cloud Security	SCA Checks	Local	medium
473002	SCA: security update for pymongo (GHSA-qx36-8mw2-4r3x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
362567	openSUSE 16 Security Update : python-pymongo (openSUSE-SU-2026:22003-1)	Nessus	SuSE Local Security Checks	Local	high
362541	SUSE SLES15 Security Update : python-pymongo (SUSE-SU-2026:4398-1)	Nessus	SuSE Local Security Checks	Local	high
350272	Linux Distros Unpatched Vulnerability : CVE-2026-96747	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-96747

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

high

medium