PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

[ Description ]Official description

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

[ Fixes ]Fixes and patches

• pymongo 4.18.2Fixed version · GitHub Advisories · pip package pymongo: upgrade to 4.18.2 or later (affected >= 3.9.0, <= 4.18.1)
• Security bulletin: MongoDB GHSA-frjf-h5jg-4v46Vendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-qx36-8mw2-4r3xVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-vp6j-j7w5-5xjjVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB 3579Vendor patch or bulletin · CERT-FR · github.com/mongodb/laravel-mongodb/pull/3579, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB v1.49.12Vendor patch or bulletin · CERT-FR · github.com/mongodb-js/compass/releases/tag/v1.49.12, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-cmvj-vxvq-rh2cVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-v4x9-3549-crwvVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3, cited by CERT-FR CERTFR-2026-AVI-1234

[ Advisories ]Government CERT advisories

• CERT-FR28 Sep 2026CERTFR-2026-AVI-1234

  Multiple vulnerabilities in MongoDB Translated from French

  Multiple vulnerabilities have been discovered in MongoDB. They allow an attacker to cause a breach of data integrity, a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-96745CVE-2026-96748CVE-2026-96747+2 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3583

  MongoDB Treiber (Python Driver, PHP Driver, C Driver, Compass and Laravel): Multiple vulnerabilities Translated from German

  CVE-2026-96744CVE-2026-96745CVE-2026-96750+4 more CVEs

[ Packages ]Affected open-source packages

• pymongo pipAffected >= 3.9.0, <= 4.18.1 · fixed in 4.18.2 · GHSA-qx36-8mw2-4r3x

[ References ]References

• github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
• github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
• github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x