Search: CVE-2026-96748

CVE-2026-96748 is a vulnerability in the PyMongo Python driver for MongoDB where improper handling of URL encoding in connection strings can allow an attacker to inject additional servers into the client's host list. This occurs because percent-encoded characters in the host portion are decoded before splitting the host list, enabling an unauthenticated party to manipulate the connection string. As a result, the application may send authentication and database operations to attacker-controlled servers, which can observe limited information and return altered results. The issue affects PyMongo versions from 0 up to but not including 4.18.2.