CVE-2026-96748: Host Injection Vulnerability in PyMongo Connection String Parsing

CVE-2026-96748 is a host injection vulnerability affecting the official MongoDB Python driver, PyMongo. The issue is located in the connection string parsing routine, specifically within the host extraction and resolution pipeline. This vulnerability occurs when applications dynamically construct MongoDB connection URIs utilizing untrusted hostnames supplied by unauthenticated third parties.

The vulnerability allows an attacker to inject arbitrary backend servers into the database client's connection pool. By crafting hostnames containing percent-encoded delimiters, such as a comma (%2C) or a colon (%3A), attackers can manipulate the connection state. The driver parses these values incorrectly, causing the client to establish connections to external, unauthorized servers.

This bug class is classified under CWE-177: Improper Handling of URL Encoding. The impact of the flaw is significant, potentially leading to unauthorized data exposure or malicious manipulation of database operations. The vulnerability was officially resolved in PyMongo version 4.18.2, which was released on September 24, 2026.

The vulnerability originates from the sequence of decoding and parsing tasks in the PyMongo URI parser modules. In affected versions of PyMongo, the driver extracts the entire host list from the connection URI as a single string. It then processes this raw string before dividing it into separate node addresses.

Specifically, the parser executes a global percent-decoding operation on the entire host block using Python's unquote_plus() function. After decoding the entire string, PyMongo invokes functions to split the string on delimiters like commas and colons. This structural ordering allows percent-encoded commas (%2C) and colons (%3A) to be decoded into actual comma and colon characters before the split occurs.

Because the decoding happens before the string splitting, characters intended as payload data are promoted to structural delimiters. The parser subsequently treats the newly decoded commas and colons as boundaries for separate host addresses. This design flaw permits any percent-encoded string to generate arbitrary entries in the driver's internal server list.

Prior to the patch, the connection string parsing logic in pymongo/synchronous/uri_parser.py (and its asynchronous counterpart) decoded the entire host segment prematurely. The variable containing the raw host addresses was passed to unquote_plus() in a single step. This resulted in the global expansion of all escaped characters across the entire substring.

# Vulnerable implementation in pymongo/synchronous/uri_parser.py
# The entire hosts string is unquoted before any delimiter checks occur
hosts = unquote_plus(hosts)
 
# The decoded string is subsequently split on the comma character
for entity in hosts.split(","):
    # This processes each entry, which now includes injected elements
    nodes.append(parse_host(entity, default_port))

The fix implemented in version 4.18.2 restructures the processing order to guarantee that splitting occurs before decoding. The global unquote_plus() call was removed entirely from the main parsing loop. The utility function split_hosts in pymongo/uri_parser_shared.py now enforces strict structural separation before performing any decoding logic.

# Patched implementation in pymongo/uri_parser_shared.py
def split_hosts(hosts: str, default_port: Optional[int] = DEFAULT_PORT) -> list[tuple[str, Optional[int]]]:
    nodes = []
    # Splitting occurs directly on the raw, undecoded hosts string
    for entity in hosts.split(","):
        if not entity:
            raise ConfigurationError("Empty host (or extra comma in host list)")
        port = default_port
        node = entity
        
        # Percent-decoding is now restricted to specific valid use cases
        if entity.endswith(".sock"):
            node = unquote_plus(entity)
            port = None
        elif entity.startswith("["):
            node = entity.replace("%25", "%")
        elif "%" in entity:
            # Rejects percent-encoding in standard hostnames
            raise InvalidURI(
                "Percent-encoding is only allowed in Unix domain socket paths "
                f"and IPv6 zone indexes, not in hostnames: {entity}"
            )
        nodes.append(parse_host(node, port))
    return nodes

This structural change ensures that standard TCP hostnames cannot contain percent-encoded control characters. Any attempt to supply a hostname containing a percent character will trigger an InvalidURI exception. The patch also updates KMS endpoint validation to prevent similar exploitation vectors when managing client-side field-level encryption.

Exploitation of this vulnerability requires an application configuration where untrusted input is interpolated into the host field of a MongoDB connection string. An attacker must find an interface that dynamically populates host values, such as a database-as-a-service manager or a tenant routing system. By supplying a crafted string, the attacker initiates the exploit chain.

For example, if an attacker registers with a hostname value of legit-host.internal%2Cattacker-dns.com%3A27017, the application inserts this string into the connection URI. During parsing, PyMongo extracts the host portion as a single entity and decodes the %2C to a comma and %3A to a colon. The driver then splits the string, yielding two distinct connection destinations: legit-host.internal and attacker-dns.com:27017.

Once parsed, both destinations are registered in the MongoClient's internal connection pool or replica set seed list. The client subsequently initiates background discovery and connection tasks to both addresses. This behavior allows the attacker's server to participate in the application's database communication channels without requiring any prior authentication.

The impact of successful host injection is critical for confidentiality and integrity. By forcing the PyMongo client to connect to an attacker-controlled server, the attacker can intercept network packets containing authentication requests. Although PyMongo employs secure authentication mechanisms like SCRAM-SHA-256, the server receives connection handshakes containing user identifiers and challenge hashes.

Beyond credential exposure, the injected server can act as an adversary-in-the-middle. If the application configuration permits query routing to secondary members of a replica set, the client may send queries directly to the rogue server. The attacker's server can return modified or fabricated data payloads to the client application, leading to integrity violations.

This vulnerability does not directly lead to arbitrary code execution on the client server. However, the capacity to manipulate query responses and harvest connection information poses a substantial threat to application security. The National Vulnerability Database assigned this flaw a CVSS v3.1 score of 6.5, while the MongoDB CNA assigned a CVSS v4.0 score of 8.3, reflecting the severe consequences in multi-tenant environments.

The recommended remediation is to upgrade the PyMongo package to version 4.18.2 or later. This version contains the structural patch that restricts percent-decoding to Unix domain socket paths and IPv6 zone indexes. Upgrading the package resolves the vulnerability at the parser level without requiring modifications to connection logic.

If an immediate package upgrade is not feasible, developers must implement strict input validation on all user-supplied host parameters. Hostnames should be verified against a strict regular expression that allows only alphanumeric characters, periods, and hyphens. Any input containing percent characters, commas, or colons must be rejected before connection string interpolation occurs.

import re
 
def sanitize_and_validate_host(host_input: str) -> str:
    # Restrict input to standard domain name characters
    if not re.match(r"^[a-zA-Z0-9.-]+$", host_input):
        raise ValueError("Invalid characters detected in host input")
    return host_input

Enforcing network-level egress restrictions is also a viable defense-in-depth measure. Configuring firewall rules to limit outgoing database connections to known, authorized IP ranges prevents the PyMongo client from establishing contact with external, rogue database seeds.