MongoDB Rust Driver vulnerabilities

5 CVEs affecting MongoDB Rust Driver, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-88024, published 2026-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-88024, published 2026-09-10. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query…
CVE-2026-81526, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that…
CVE-2021-20332, published 2021-08-02. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's…
CVE-2024-6382, published 2024-07-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This…
CVE-2025-11695, published 2025-10-13. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5