CVE-2026-88031
CVE
High
· CVSS 8.1
False PositiveMongoDB Go Driver: GridFS Chunk Deletion via Query Injection in File Identifier
This advisory does not affect KrakenD
The MongoDB Go Driver is only present in KrakenD as a transitive dependency of a
third-party library, and only its BSON encoding packages are compiled in. The GridFS
code is not part of the KrakenD binary. KrakenD does not connect to MongoDB.
Component
MongoDB Go Driver (GridFS)
Disclosed
Nov 4, 2026
CVSS Score
8.1
Description
The GridFS component of the MongoDB Go Driver can interpret a caller-supplied
structured file identifier as a query condition instead of a literal identifier. An
authenticated user who can influence the identifier passed by an affected application
may cause all file chunks in a GridFS bucket to be removed, leaving the stored files
unreadable. This does not affect KrakenD.