CVE-2026-114649

MediumCVSS 6.8/10Last modified Oct 23, 2026

Description

The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1025

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MongoDBC# Driver>= 1.8.0, < 3.13.0

References

Timeline

Published
Oct 22, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-114653.1A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the filCVE-2026-1146505.9A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption CVE-2026-1146514.0A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processedCVE-2026-1146526.5A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supCVE-2026-1146536.5A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position thaCVE-2026-1146546.5A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied thCVE-2026-1146555.9libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS proCVE-2026-1146567.5Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certifiCVE-2026-1146575.7Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credeCVE-2026-1146588.8Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors CVE-2026-1146596.5Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes checCVE-2026-114665.4A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepse