# CVE-2026-88029: pymongo: Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver...

CVE-2026-88029 is fixed in 37 products on 1 platform, first by DEBIAN-CVE-2026-88029, released September 18, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-88029
- Priority: High
- CVSS: 8.3 (Important)
- EPSS: 0.0027
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 10, 2026

## Description

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | pymongo Debian 14 | 4.18.1-1 | [DEBIAN-CVE-2026-88029](https://patchblox.com/security/data/fix/linux/debian-cve-2026-88029.md) | Sep 18, 2026 |
| Linux | python-PyMySQL rocky 8 | 0:0.10.1-2.module+el8.10.0+1860+afcc1c71 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-distro rocky 8 | 0:1.4.0-2.module+el8.10.0+1910+234ad790 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-docs rocky 8 | 0:3.6.7-2.module+el8.10.0+1592+61442852 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-docutils rocky 8 | 0:0.14-12.module+el8.10.0+1592+61442852 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-nose rocky 8 | 0:1.3.7-31.module+el8.10.0+1592+61442852 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-nose-docs RHEL 8 | 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python-nose-docs almalinux 8 | 1.3.7-31.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-nose-docs ol 8 | 0:1.3.7-31.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-pygments rocky 8 | 0:2.2.0-22.module+el8.10.0+40170+5f5fdfeb | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-pymongo-debuginfo amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python-pymongo-debugsource amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python-pymongo-doc RHEL 8 | 0:3.7.0-3.module+el8.10.0+25000+2cc6bf61 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python-pymongo-doc almalinux 8 | 3.7.0-3.module_el8.10.0+4300+ca04280a | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-pymongo-doc amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python-pymongo-doc ol 8 | 0:3.7.0-3.module+el8.10.0+91063+60d69350 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-sqlalchemy rocky 8 | 0:1.3.2-3.module+el8.10.0+1602+b47e27fa | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-sqlalchemy-doc RHEL 8 | 0:1.3.2-3.module+el8.10.0+20981+3704b446 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python-sqlalchemy-doc almalinux 8 | 1.3.2-3.module_el8.10.0+3769+3838165b | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-sqlalchemy-doc ol 8 | 0:1.3.2-3.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-virtualenv rocky 8 | 0:15.1.0-23.module+el8.10.0+1910+234ad790 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-virtualenv-doc RHEL 8 | 0:15.1.0-23.module+el8.10.0+22619+61b70790 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python-virtualenv-doc almalinux 8 | 15.1.0-23.module_el8.10.0+3937+b6a3652f | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-virtualenv-doc ol 8 | 0:15.1.0-23.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python-wheel rocky 8 | 1:0.31.1-3.module+el8.10.0+40170+5f5fdfeb | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-PyMySQL RHEL 8 | 0:0.10.1-2.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-PyMySQL almalinux 8 | 0.10.1-2.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-PyMySQL ol 8 | 0:0.10.1-2.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-bson RHEL 8 | 0:3.7.0-3.module+el8.10.0+25000+2cc6bf61 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-bson almalinux 8 | 3.7.0-3.module_el8.10.0+4300+ca04280a | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-bson amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python3-bson ol 8 | 0:3.7.0-3.module+el8.10.0+91063+60d69350 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-bson-debuginfo amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python3-distro RHEL 8 | 0:1.4.0-2.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-distro almalinux 8 | 1.4.0-2.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-distro ol 8 | 0:1.4.0-2.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-docs RHEL 8 | 0:3.6.7-2.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-docs almalinux 8 | 3.6.7-2.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-docs ol 8 | 0:3.6.7-2.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-docutils RHEL 8 | 0:0.14-12.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-docutils almalinux 8 | 0.14-12.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-docutils ol 8 | 0:0.14-12.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-nose RHEL 8 | 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-nose almalinux 8 | 1.3.7-31.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-nose ol 8 | 0:1.3.7-31.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-pygments RHEL 8 | 0:2.2.0-22.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-pygments almalinux 8 | 2.2.0-22.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-pygments ol 8 | 0:2.2.0-22.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-pymongo RHEL 8 | 0:3.7.0-3.module+el8.10.0+25000+2cc6bf61 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-pymongo almalinux 8 | 3.7.0-3.module_el8.10.0+4300+ca04280a | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-pymongo amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python3-pymongo ol 8 | 0:3.7.0-3.module+el8.10.0+91063+60d69350 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-pymongo-debuginfo amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python3-pymongo-gridfs RHEL 8 | 0:3.7.0-3.module+el8.10.0+25000+2cc6bf61 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-pymongo-gridfs almalinux 8 | 3.7.0-3.module_el8.10.0+4300+ca04280a | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-pymongo-gridfs amzn 2023 | 3.10.1-5.amzn2023.0.4 | [ALAS2023-2026-3121](https://patchblox.com/security/data/fix/linux/alas2023-2026-3121.md) | Sep 28, 2026 |
| Linux | python3-pymongo-gridfs ol 8 | 0:3.7.0-3.module+el8.10.0+91063+60d69350 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-scipy RHEL 8 | 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-scipy almalinux 8 | 1.0.0-21.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-scipy ol 8 | 0:1.0.0-21.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-sqlalchemy RHEL 8 | 0:1.3.2-3.module+el8.10.0+20981+3704b446 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-sqlalchemy almalinux 8 | 1.3.2-3.module_el8.10.0+3769+3838165b | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-sqlalchemy ol 8 | 0:1.3.2-3.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-virtualenv RHEL 8 | 0:15.1.0-23.module+el8.10.0+22619+61b70790 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-virtualenv almalinux 8 | 15.1.0-23.module_el8.10.0+3937+b6a3652f | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-virtualenv ol 8 | 0:15.1.0-23.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-wheel RHEL 8 | 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-wheel almalinux 8 | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-wheel ol 8 | 1:0.31.1-3.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-wheel-wheel RHEL 8 | 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python3-wheel-wheel almalinux 8 | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python3-wheel-wheel ol 8 | 1:0.31.1-3.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36 RHEL 8 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python36 almalinux 8 | 3.6.8-39.module_el8.10.0+3769+3838165b | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36 ol 8 | 0:3.6.8-39.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36 rocky 8 | 0:3.6.8-39.module+el8.10.0+1592+61442852 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36-debug RHEL 8 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python36-debug almalinux 8 | 3.6.8-39.module_el8.10.0+3769+3838165b | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36-debug ol 8 | 0:3.6.8-39.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36-devel RHEL 8 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python36-devel almalinux 8 | 3.6.8-39.module_el8.10.0+3769+3838165b | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36-devel ol 8 | 0:3.6.8-39.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36-rpm-macros RHEL 8 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | [RHSA-2026:82858](https://patchblox.com/security/data/fix/linux/rhsa-2026-82858.md) | Oct 16, 2026 |
| Linux | python36-rpm-macros almalinux 8 | 3.6.8-39.module_el8.10.0+3769+3838165b | [ALSA-2026:82858](https://patchblox.com/security/data/fix/linux/alsa-2026-82858.md) | Nov 7, 2026 |
| Linux | python36-rpm-macros ol 8 | 0:3.6.8-39.module+el8.10.0+90473+c30184f9 | [ELSA-2026-82858](https://patchblox.com/security/data/fix/linux/elsa-2026-82858.md) | Nov 7, 2026 |
| Linux | scipy rocky 8 | 0:1.0.0-21.module+el8.10.0+1592+61442852 | [RLSA-2026:82858](https://patchblox.com/security/data/fix/linux/rlsa-2026-82858.md) | Nov 7, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.