# CVE-2026-96748

PyMongo host parsing allows attacker to inject malicious hosts into client connections

- Page: https://www.vulneraibility.com/cve/CVE-2026-96748
- CVSS: 8.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.36% (percentile 30.2)
- CISA SSVC: exploitation none, automatable no, technical impact partial (assessed 2026-09-24)
- Weakness: CWE-177
- Also known as: GHSA-vp6j-j7w5-5xjj, PYSEC-2026-4297
- Published: 2026-09-24

## Affected versions

- MongoDB Python Driver: affected < 4.18.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Inject hosts into connection strings so clients connect to attacker servers, exposing authentication exchanges and enabling data observation or tampering.

## Action

Immediate action required

## Recommendation

Upgrade PyMongo to 4.18.2+; validate or avoid untrusted host input

## References

- [other] https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj
- [other] https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- [other] https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.