PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host
    list is separated on its delimiters. When an application places a hostname value supplied by an
    unauthenticated party into a connection string, that party may cause additional servers of their choosing
    to be added to the application's database client. The application may then send its authentication
    exchange and database operations to one of those servers, which can observe limited information and return
    altered results. (CVE-2026-96748)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22003-1 advisory.

    Changes in python-pymongo:

    - CVE-2026-96749: integer overflow in BSON document encoding allows an       unprivileged user to write outside the bounds of an allocated buffer       (bsc#1282845)
    - CVE-2026-96748: host injection in connection string leading to       database connection redirection due to improper connection string       parsing (bsc#1282827)
    - CVE-2026-96747: improper handling of key management endpoint values       ending in `.sock` allows users with write access to the encryption       key metadata to open connections to local sockets on the application       host (bsc#1282844)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4398-1 advisory.

    - CVE-2026-96747: improper handling of key management endpoint values ending in `.sock` allows users with     write access       to the encryption key metadata to open connections to local sockets on the application host     (bsc#1282844).
    - CVE-2026-96748: host injection in connection string leading to database connection redirection due to     improper       connection string parsing (bsc#1282827).
    - CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside     the bounds of       an allocated buffer (bsc#1282845).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host     list is separated on its delimiters. When an application places a hostname value supplied by an     unauthenticated party into a connection string, that party may cause additional servers of their choosing     to be added to the application's database client. The application may then send its authentication     exchange and database operations to one of those servers, which can observe limited information and return     altered results. (CVE-2026-96748)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473548	Echo: pymongo: security update to 4.18.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
473548	Echo: pymongo: security update to 4.18.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
473497	Chainguard: multiple localstack packages: security update to 4.14.0-r29	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
473497	Chainguard: multiple localstack packages: security update to 4.14.0-r29	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
472981	SCA: security update for pymongo (GHSA-vp6j-j7w5-5xjj)	Tenable Cloud Security	SCA Checks	Local	high
472981	SCA: security update for pymongo (GHSA-vp6j-j7w5-5xjj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
362567	openSUSE 16 Security Update : python-pymongo (openSUSE-SU-2026:22003-1)	Nessus	SuSE Local Security Checks	Local	high
362541	SUSE SLES15 Security Update : python-pymongo (SUSE-SU-2026:4398-1)	Nessus	SuSE Local Security Checks	Local	high
350277	Linux Distros Unpatched Vulnerability : CVE-2026-96748	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-96748

high

Tenable Plugins

high

high

high

high

high

high

high

high

high