CVE-2026-114655

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114655

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114655.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114655

Aliases

GHSA-7mvq-mg47-m88j

Published

2026-10-22T19:14:00Z

Modified

2026-10-23T10:45:32Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

KMS request injection via unsanitized key vault and provider values in libmongocrypt

Details

libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.

Database specific

{
    "cna_assigner":  "mongodb",
    "cwe_ids":  [
        "CWE-74"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114655.json"
}

References

Affected packages

Git / github.com/mongodb/libmongocrypt

Affected ranges

Type

GIT

Repo

https://github.com/mongodb/libmongocrypt

Events

Introduced

db663b458b8680df9b81ff8cde7053633c155fb6

Fixed

f0a7100caae87f9f4806b3a04d86494cfccac726

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "1.21.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "original_tag":  "1.21.1",
            "range":  [
                {
                    "fixed":  "f0a7100caae87f9f4806b3a04d86494cfccac726"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*

1.0.1

1.0.1-rc0

1.0.2

1.0.3

1.0.4

1.1.0

1.1.0-beta1

1.10.0b0

1.10.0b1

1.2.0

1.2.1

1.2.2

1.3.0

1.3.0-beta1

1.3.1

1.4.0-alpha0

1.5.0-alpha0

1.5.0-alpha1

1.5.0-alpha2

1.5.0-rc0

1.5.0-rc1

1.5.0-rc2

1.6.0-alpha0

1.7.0-alpha0

1.7.0-alpha1

1.7.0-alpha2

1.8.0-alpha0

1.8.0-alpha1

csharp-v1.*

csharp-v1.1.0-beta01

csharp-v1.1.0-beta02

csharp-v1.1.0-beta03

csharp-v1.1.0-beta04

csharp-v1.10.0

csharp-v1.11.0

csharp-v1.2.0

csharp-v1.2.1

csharp-v1.2.2

csharp-v1.2.3

csharp-v1.3.0

csharp-v1.5.0

csharp-v1.5.1

csharp-v1.5.2

csharp-v1.5.4

csharp-v1.5.5

csharp-v1.6.0

csharp-v1.7.0

csharp-v1.8.0

csharp-v1.8.0-alpha.0

csharp-v1.8.1

csharp-v1.8.2

csharp-v1.9.0

debian/1.*

debian/1.1.0-1

java-1.*

java-1.11.0

java-1.6.0-alpha0

java-1.8.0-alpha0

node-v1.*

node-v1.0.0

node-v1.0.1

node-v1.1.0

node-v1.2.0

node-v1.2.1

node-v1.2.2

node-v1.2.3

node-v1.2.4

node-v1.2.5

node-v1.2.6

node-v1.2.7

node-v2.*

node-v2.0.0

node-v2.0.0-beta.0

node-v2.0.0-beta.3

node-v2.0.0-beta.4

node-v2.1.0

node-v2.2.0

node-v2.2.0-alpha.0

node-v2.2.0-alpha.1

node-v2.2.0-alpha.2

node-v2.2.0-alpha.3

node-v2.2.0-alpha.4

node-v2.2.0-alpha.5

node-v2.2.0-alpha.6

node-v2.2.1

node-v2.3.0

node-v2.4.0

node-v2.4.0-alpha.0

node-v2.4.0-alpha.1

node-v2.4.0-alpha.2

node-v2.5.0

node-v2.6.0

node-v2.6.0-alpha.0

node-v2.7.0

node-v2.7.0-alpha.0

node-v2.7.1

node-v2.8.0

node-v2.8.0-alpha.0

node-v2.9.0

node-v6.*

node-v6.0.0

node-v6.0.0-alpha.2

node-v6.0.0-alpha.3

node-v6.0.1

pymongocrypt-1.*

pymongocrypt-1.0.0

pymongocrypt-1.0.1

pymongocrypt-1.1.0

pymongocrypt-1.1.0b0

pymongocrypt-1.1.1

pymongocrypt-1.1.2

pymongocrypt-1.10.0

pymongocrypt-1.10.1

pymongocrypt-1.11.0

pymongocrypt-1.12.0

pymongocrypt-1.12.1

pymongocrypt-1.12.2

pymongocrypt-1.12.2rc1

pymongocrypt-1.12.2rc2

pymongocrypt-1.12.2rc4

pymongocrypt-1.13.0

pymongocrypt-1.14.0

pymongocrypt-1.14.1

pymongocrypt-1.15.0

pymongocrypt-1.15.1

pymongocrypt-1.16.0

pymongocrypt-1.17.0

pymongocrypt-1.18.0

pymongocrypt-1.18.0.dev0

pymongocrypt-1.18.1

pymongocrypt-1.19.0

pymongocrypt-1.2.0

pymongocrypt-1.2.2rc0

pymongocrypt-1.20.0

pymongocrypt-1.20.0.dev0

pymongocrypt-1.21.0

pymongocrypt-1.3.0

pymongocrypt-1.3.0b0

pymongocrypt-1.3.1

pymongocrypt-1.4.0

pymongocrypt-1.4.1

pymongocrypt-1.5.0

pymongocrypt-1.5.1

pymongocrypt-1.5.2

pymongocrypt-1.6.0

pymongocrypt-1.6.1

pymongocrypt-1.7.0

pymongocrypt-1.8.0

pymongocrypt-1.9.0

pymongocrypt-1.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114655.json"