Restoring someone else's dump can create a root account
On 3 November 2026 MongoDB published four security advisories at once. None of the four is patched on the server: all of them close by moving Database Tools to 100.20.1, the package of binaries that lives on a technician's laptop, in the container image running the nightly backup and on the jump host. Inside: why excluding the admin namespace doesn't save you (the advisory says so), the four CVEs with their two contradictory scores, what the changelog tells you and the advisories don't, why your scanner will find nothing, why Ubuntu no longer ships the package, when this is NOT urgent, and the six-check inventory.
Microsoft 365
ES 
CAT 
EN