CVE-2026-119675 mongorestore may bypass collection guards through a system.buckets prefix

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized...

CVE-2026-119675

The mongorestore utility in MongoDB Database Tools (versions 100.4.0 through before 100.20.1) inconsistently handles the system.buckets. prefix during collection name validation in untrusted dumps. This allows a specially crafted collection name to bypass special-collection guards and operator na...