Threats tagged 'brew-mongo-orchestration-cve-2026-96747'

PyMongo versions >=0.7.0 and <0.11.2_4 contain a vulnerability where the KMS endpoint from a key vault document is passed verbatim to a host parser. If the endpoint ends with '.sock', the driver treats it as a Unix domain socket path and attempts an AF_UNIX connection. This allows an attacker who can write to the key vault collection to redirect KMS connections to arbitrary Unix socket paths on the application host. The TLS handshake always fails, so no KMS messages are sent. The issue is fixed in PyMongo 0.11.2_4.