CVE-2026-14881

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-14881

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14881.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-14881

Published

2026-07-22T19:23:17.455Z

Modified

2026-07-24T04:01:29.117266956Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

Details

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "mongodb",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14881.json"
}

References

Affected packages

Git / github.com/mongodb-js/compass

Affected ranges

Type

GIT

Repo

https://github.com/mongodb-js/compass

Events

Introduced

92a83ce4304f35618d28dc85df8f498d4d2a4689

Fixed

32d69fea785e04dd7e4a4403ca754cda4b81398c

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.38.0"
        },
        {
            "fixed": "1.49.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14881.json"