CVE-2026-88030
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
02 Description
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 0.26% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 18.2% of scored records. A rank, not a probability.
- NVD base score
- 6.1 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-09-29.
- Red Hat severity
- Important. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-09-10 17:57Z1 MO AGO
- Last updated
- 2026-09-10 18:25Z1 MO AGO
- Reserved
- 2026-09-09
- Assigning CNA
- mongodb
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.1)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- Data version
- 5.2
- Document digest
- 9d7c9acfb663b2c358d1632ad92529fda1923296e3898f66df20dee54c5e22f2
05 Affected products
06 References
- jira.mongodb.orghttps://jira.mongodb.org/browse/RUBY-3941
07 Fixed in
AlmaLinux 8
- ruby Fixed in 2.5.9-116.module_el8.10.0+4294+1072b022
- ruby-devel Fixed
A version is affected if any line below covers it.
- Affected before 2.5.9-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.5.9-116.module_el8.10.0+4294+1072b022
- ruby-doc Fixed in 2.5.9-116.module_el8.10.0+4294+1072b022
- ruby-irb Fixed in 2.5.9-116.module_el8.10.0+4293+d4d7c902
- ruby-libs Fixed
A version is affected if any line below covers it.
- Affected before 2.5.9-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.5.9-116.module_el8.10.0+4294+1072b022
- rubygem-abrt Fixed in 0.3.0-4.module_el8.5.0+2625+ec418553
- rubygem-abrt-doc Fixed in 0.3.0-4.module_el8.10.0+3871+342e2c2f
- rubygem-bigdecimal Fixed
A version is affected if any line below covers it.
- Affected before 1.3.4-116.module_el8.10.0+4293+d4d7c902
- Affected before 1.3.4-116.module_el8.10.0+4294+1072b022
- rubygem-bson Fixed
A version is affected if any line below covers it.
- Affected before 4.3.0-2.module_el8.5.0+259+8cec6917
- Affected before 4.3.0-2.module_el8.5.0+2625+ec418553
- Affected before 4.3.0-2.module_el8.6.0+3170+4b08f9d4
- rubygem-bson-doc Fixed in 4.3.0-2.module_el8.5.0+2625+ec418553
- rubygem-bundler Fixed in 1.16.1-5.module_el8.10.0+3991+5e651d4e
- rubygem-bundler-doc Fixed in 1.16.1-5.module_el8.10.0+3991+5e651d4e
- rubygem-did_you_mean Fixed in 1.2.0-116.module_el8.10.0+4293+d4d7c902
- rubygem-io-console Fixed
A version is affected if any line below covers it.
- Affected before 0.4.6-116.module_el8.10.0+4293+d4d7c902
- Affected before 0.4.6-116.module_el8.10.0+4294+1072b022
- rubygem-json Fixed
A version is affected if any line below covers it.
- Affected before 2.1.0-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.1.0-116.module_el8.10.0+4294+1072b022
- rubygem-minitest Fixed in 5.10.3-116.module_el8.10.0+4294+1072b022
- rubygem-mongo Fixed in 2.5.1-3.module_el8.10.0+4294+1072b022
- rubygem-mongo-doc Fixed in 2.5.1-3.module_el8.10.0+4294+1072b022
- rubygem-mysql2 Fixed
A version is affected if any line below covers it.
- Affected before 0.4.10-4.module_el8.5.0+259+8cec6917
- Affected before 0.4.10-4.module_el8.5.0+2625+ec418553
- Affected before 0.4.10-4.module_el8.6.0+3170+4b08f9d4
- rubygem-mysql2-doc Fixed in 0.4.10-4.module_el8.5.0+2625+ec418553
- rubygem-net-telnet Fixed in 0.1.1-116.module_el8.10.0+4294+1072b022
- rubygem-openssl Fixed
A version is affected if any line below covers it.
- Affected before 2.1.2-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.1.2-116.module_el8.10.0+4294+1072b022
- rubygem-pg Fixed in 1.0.0-3.module_el8.9.0+3635+c6f99506
- rubygem-pg-doc Fixed in 1.0.0-3.module_el8.9.0+3635+c6f99506
- rubygem-power_assert Fixed in 1.1.1-116.module_el8.10.0+4294+1072b022
- rubygem-psych Fixed
A version is affected if any line below covers it.
- Affected before 3.0.2-116.module_el8.10.0+4293+d4d7c902
- Affected before 3.0.2-116.module_el8.10.0+4294+1072b022
- rubygem-rake Fixed in 12.3.3-116.module_el8.10.0+4294+1072b022
- rubygem-rdoc Fixed in 6.0.1.1-116.module_el8.10.0+4293+d4d7c902
- rubygem-test-unit Fixed in 3.2.7-116.module_el8.10.0+4293+d4d7c902
- rubygem-xmlrpc Fixed in 0.3.0-116.module_el8.10.0+4293+d4d7c902
- rubygems Fixed in 2.7.6.3-116.module_el8.10.0+4294+1072b022
- rubygems-devel Fixed in 2.7.6.3-116.module_el8.10.0+4293+d4d7c902
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 8
- ruby Fixed in 2.5.9-116.module_el8.10.0+4294+1072b022
- ruby-devel Fixed
A version is affected if any line below covers it.
- Affected before 2.5.9-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.5.9-116.module_el8.10.0+4294+1072b022
- ruby-doc Fixed in 2.5.9-116.module_el8.10.0+4294+1072b022
- ruby-irb Fixed in 2.5.9-116.module_el8.10.0+4293+d4d7c902
- ruby-libs Fixed
A version is affected if any line below covers it.
- Affected before 2.5.9-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.5.9-116.module_el8.10.0+4294+1072b022
- rubygem-abrt Fixed in 0.3.0-4.module_el8.5.0+2625+ec418553
- rubygem-abrt-doc Fixed in 0.3.0-4.module_el8.10.0+3871+342e2c2f
- rubygem-bigdecimal Fixed
A version is affected if any line below covers it.
- Affected before 1.3.4-116.module_el8.10.0+4293+d4d7c902
- Affected before 1.3.4-116.module_el8.10.0+4294+1072b022
- rubygem-bson Fixed
A version is affected if any line below covers it.
- Affected before 4.3.0-2.module_el8.5.0+259+8cec6917
- Affected before 4.3.0-2.module_el8.5.0+2625+ec418553
- Affected before 4.3.0-2.module_el8.6.0+3170+4b08f9d4
- rubygem-bson-doc Fixed in 4.3.0-2.module_el8.5.0+2625+ec418553
- rubygem-bundler Fixed in 1.16.1-5.module_el8.10.0+3991+5e651d4e
- rubygem-bundler-doc Fixed in 1.16.1-5.module_el8.10.0+3991+5e651d4e
- rubygem-did_you_mean Fixed in 1.2.0-116.module_el8.10.0+4293+d4d7c902
- rubygem-io-console Fixed
A version is affected if any line below covers it.
- Affected before 0.4.6-116.module_el8.10.0+4293+d4d7c902
- Affected before 0.4.6-116.module_el8.10.0+4294+1072b022
- rubygem-json Fixed
A version is affected if any line below covers it.
- Affected before 2.1.0-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.1.0-116.module_el8.10.0+4294+1072b022
- rubygem-minitest Fixed in 5.10.3-116.module_el8.10.0+4294+1072b022
- rubygem-mongo Fixed in 2.5.1-3.module_el8.10.0+4294+1072b022
- rubygem-mongo-doc Fixed in 2.5.1-3.module_el8.10.0+4294+1072b022
- rubygem-mysql2 Fixed
A version is affected if any line below covers it.
- Affected before 0.4.10-4.module_el8.5.0+259+8cec6917
- Affected before 0.4.10-4.module_el8.5.0+2625+ec418553
- Affected before 0.4.10-4.module_el8.6.0+3170+4b08f9d4
- rubygem-mysql2-doc Fixed in 0.4.10-4.module_el8.5.0+2625+ec418553
- rubygem-net-telnet Fixed in 0.1.1-116.module_el8.10.0+4294+1072b022
- rubygem-openssl Fixed
A version is affected if any line below covers it.
- Affected before 2.1.2-116.module_el8.10.0+4293+d4d7c902
- Affected before 2.1.2-116.module_el8.10.0+4294+1072b022
- rubygem-pg Fixed in 1.0.0-3.module_el8.9.0+3635+c6f99506
- rubygem-pg-doc Fixed in 1.0.0-3.module_el8.9.0+3635+c6f99506
- rubygem-power_assert Fixed in 1.1.1-116.module_el8.10.0+4294+1072b022
- rubygem-psych Fixed
A version is affected if any line below covers it.
- Affected before 3.0.2-116.module_el8.10.0+4293+d4d7c902
- Affected before 3.0.2-116.module_el8.10.0+4294+1072b022
- rubygem-rake Fixed in 12.3.3-116.module_el8.10.0+4294+1072b022
- rubygem-rdoc Fixed in 6.0.1.1-116.module_el8.10.0+4293+d4d7c902
- rubygem-test-unit Fixed in 3.2.7-116.module_el8.10.0+4293+d4d7c902
- rubygem-xmlrpc Fixed in 0.3.0-116.module_el8.10.0+4293+d4d7c902
- rubygems Fixed in 2.7.6.3-116.module_el8.10.0+4294+1072b022
- rubygems-devel Fixed in 2.7.6.3-116.module_el8.10.0+4293+d4d7c902
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- ruby-mongo No fix yet
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- ruby-mongo No fix yet
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- ruby-mongo Fixed in 2.26.0-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 16.04 LTS
- ruby-mongo No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- ruby-mongo No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- ruby-mongo No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- ruby-mongo No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- ruby-mongo No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.04 LTS
- ruby-mongo No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.10
- ruby-mongo No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.