The MongoDB Python Driver’s client‑side field level encryption can mistakenly treat a key management endpoint ending in ".sock" as a path to a local Unix domain socket rather than an external server. A user who can write to the encryption key metadata stored in the database can force an application using the driver to open a connection to a local socket on the application host. Only the initial part of a TLS handshake is transmitted, so the attacker cannot choose arbitrary content, but the ability to initiate local connections could allow exploitation of other listening services or denial of service. The impact is therefore a local misconfiguration that could expose intermediate services to local attackers. The affected system is the MongoDB Python Driver. All versions prior to the 4.18.2 release are potentially vulnerable, as the advisory and changelog indicate the issue was fixed in that version. The driver is used by Python applications that interact with MongoDB databases. Risk assessment shows a medium CVSS score of 5.3, no EPSS data, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires local write access to key metadata, typically an insider or compromised role, making the likelihood of exploitation moderate in environments where such permissions are not strictly controlled.

Python applications that use the MongoDB Python Driver are affected. Versions earlier than 4.18.2 contain the vulnerability; the 4.18.2 release and later incorporate the fix.

The CVSS base score of 5.3 indicates a medium impact. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker have write permissions to the encryption key metadata in the MongoDB database, which typically corresponds to an insider or a role with elevated privileges. Because such permissions are generally tightly controlled, the probability of exploitation is moderate in well‑managed environments.