RHSA-2026:90314HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 RHEL 10 Container Release.

Published
October 26, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-88031 →

📋 Description

CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs

🎯 Affected products5

  • Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/udi-base-rhel10@sha256:9c72492e68c05826f88c01d358ea8cd7ce62f68577248425ecc705cffb6b065f_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/udi-base-rhel10@sha256:9d30656a8a007f004df60aac2ddfdb591ee7532746c6aa149d7f1bdf7321015d_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/udi-base-rhel10@sha256:a7eb50f97461cd0377dedcef6771e829e69aa5bab27d07c8b6a198620186d0d9_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/udi-base-rhel10@sha256:d0cf86806e7684940728bdc9f02ccd94e4f26e038447afcfcf524c7b1e71f900_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).

🔗 References (5)