CVE-2026-96745 Overview
CVE-2026-96745 is an insecure deserialization vulnerability [CWE-502] in the MongoDB PHP Driver. The flaw resides in the driver's command monitoring support. When an application registers a command monitoring subscriber and passes untrusted data into a database operation, the driver honors class names embedded in document content while building monitoring event objects. An unauthenticated attacker who controls that data can trigger instantiation of any application class implementing the driver's persistable interface and invoke its unserialization method with attacker-supplied data.
Critical Impact
Attacker-controlled document content can force the MongoDB PHP Driver to instantiate arbitrary persistable classes and invoke their unserialization logic, producing impact that depends on gadget classes available in the target application.
Affected Products
- MongoDB PHP Driver (mongodb/mongo-php-driver) 1.x prior to 1.21.10
- MongoDB PHP Driver 2.1.x prior to 2.1.10
- MongoDB PHP Driver 2.5.x prior to 2.5.3
Discovery Timeline
- 2026-09-24 - CVE CVE-2026-96745 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-96745
Vulnerability Analysis
The MongoDB PHP Driver exposes a command monitoring API that lets applications subscribe to events describing BSON documents sent to and received from the server. When the driver builds those monitoring event objects, it processes BSON type information embedded in document fields. The vulnerable code paths honor class name hints in that content and resolve them to PHP classes that implement the driver's persistable document interface.
Once the driver matches a class, it instantiates the object and invokes its bsonUnserialize() method with the attacker-supplied field data. Any class in the application's autoload graph that implements the persistable interface becomes a potential gadget. Confidentiality, integrity, and availability impact depend entirely on what those classes do during unserialization.
Root Cause
The root cause is unsafe deserialization of untrusted data during command monitoring event construction. The driver trusts the __pclass type hint carried inside BSON content without restricting it to a safe allow-list. Any application that both subscribes to command monitoring and routes untrusted input into MongoDB operations exposes the deserialization path to external attackers.
Attack Vector
Exploitation requires that the target application register a command monitoring subscriber and include attacker-controlled data in a MongoDB operation. The attacker submits data containing a crafted type hint referencing an application class that implements the persistable interface. When the driver fires the monitoring event, it instantiates that class and calls its unserialization method with attacker-controlled fields. No authentication to the MongoDB server is required; the attack originates from the application's untrusted input surface.
No public proof-of-concept code has been published. See the GitHub Security Advisory GHSA-cmvj-vxvq-rh2c and GitHub Pull Request #2115 for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-96745
Indicators of Compromise
- BSON documents in application logs or MongoDB traffic containing unexpected __pclass type hints that reference application-defined classes.
- Unexpected instantiations of classes implementing MongoDB\BSON\Persistable traced to command monitoring event handlers.
- PHP error or warning entries emitted from bsonUnserialize() implementations invoked with malformed field data.
Detection Strategies
- Inventory PHP applications using mongodb/mongo-php-driver and identify any that call MongoDB\Driver\Monitoring\addSubscriber() with a command monitoring subscriber.
- Review input-handling code paths that forward user-supplied values into MongoDB queries, inserts, or updates without strict schema validation.
- Audit application classes that implement MongoDB\BSON\Persistable and assess what their bsonUnserialize() methods do with field data.
Monitoring Recommendations
- Alert on PHP application exceptions originating in command monitoring subscriber callbacks.
- Capture and inspect BSON payloads at the application boundary for __pclass fields referencing unexpected class names.
- Correlate web request telemetry with MongoDB driver version data to flag hosts still running pre-patch builds.
How to Mitigate CVE-2026-96745
Immediate Actions Required
- Upgrade the MongoDB PHP Driver to 1.21.10, 2.1.10, or 2.5.3 depending on the branch in use.
- If upgrading immediately is not possible, disable or remove command monitoring subscribers that process untrusted operations.
- Validate and sanitize any user-controlled data before passing it to MongoDB operations, rejecting documents containing unexpected __pclass fields.
Patch Information
MongoDB released fixed versions in GitHub Release 1.21.10, GitHub Release 2.1.10, and GitHub Release 2.5.3. The code change is tracked in GitHub Pull Request #2115 and documented in GitHub Security Advisory GHSA-cmvj-vxvq-rh2c.
Workarounds
- Remove command monitoring subscribers registered via MongoDB\Driver\Monitoring\addSubscriber() until the driver can be patched.
- Enforce strict server-side schema validation that rejects documents containing __pclass keys from untrusted sources.
- Avoid implementing MongoDB\BSON\Persistable on classes whose bsonUnserialize() methods perform sensitive actions.
# Upgrade the MongoDB PHP Driver via PECL to a patched release
pecl upgrade mongodb-1.21.10
# or, for the 2.x branches
pecl upgrade mongodb-2.1.10
pecl upgrade mongodb-2.5.3
# Verify the installed driver version
php --ri mongodb | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
