CVE-2026-84962

MediumCVSS 4.2/10Last modified Sep 17, 2026

Description

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2026
Last modified: Sep 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-849635.3An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value CVE-2026-849647.5A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that th CVE-2026-849655.5An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a fo CVE-2026-849665.5An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interp CVE-2026-849674.3A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value CVE-2026-849685.3An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially for CVE-2026-849693.7A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a h CVE-2026-84977.4Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Andr CVE-2026-849705.8A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text CVE-2026-849716.5Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check t CVE-2026-849757.4PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib CVE-2026-849897.1ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng