CVE-2026-84962

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84962
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84962.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84962
Downstream
Published
2026-09-03T15:03:52Z
Modified
2026-09-19T03:47:24Z
Severity
  • 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
Details

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Database specific 
{
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84962.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1.20.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/mongodb/libmongocrypt

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/libmongocrypt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8f152f3e88e8c4dd99d3f497ae10747fc791c9f9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mongodb:libmongocrypt:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.20.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*
1.0.0
1.0.0-beta1
1.0.0-beta2
1.0.0-beta3
1.0.0-beta4
1.0.0-beta5
1.0.0-rc0
1.0.0-rc1
1.0.0-rc2
1.0.0-rc3
1.0.1
1.0.1-rc0
1.0.2
1.0.3
1.0.4
1.1.0
1.1.0-beta1
1.10.0b0
1.10.0b1
1.2.0
1.2.1
1.2.2
1.20.0
1.20.1
1.3.0
1.3.0-beta1
1.3.1
1.4.0-alpha0
1.5.0-alpha0
1.5.0-alpha1
1.5.0-alpha2
1.5.0-rc0
1.5.0-rc1
1.5.0-rc2
1.6.0-alpha0
1.7.0-alpha0
1.7.0-alpha1
1.7.0-alpha2
1.8.0-alpha0
1.8.0-alpha1
csharp-v1.*
csharp-v1.0.0
csharp-v1.0.0-beta01
csharp-v1.0.0-beta02
csharp-v1.0.0-beta03
csharp-v1.1.0-beta01
csharp-v1.1.0-beta02
csharp-v1.1.0-beta03
csharp-v1.1.0-beta04
csharp-v1.10.0
csharp-v1.11.0
csharp-v1.2.0
csharp-v1.2.1
csharp-v1.2.2
csharp-v1.2.3
csharp-v1.3.0
csharp-v1.5.0
csharp-v1.5.1
csharp-v1.5.2
csharp-v1.5.4
csharp-v1.5.5
csharp-v1.6.0
csharp-v1.7.0
csharp-v1.8.0
csharp-v1.8.0-alpha.0
csharp-v1.8.1
csharp-v1.8.2
csharp-v1.9.0
debian/1.*
debian/1.1.0-1
java-1.*
java-1.11.0
java-1.6.0-alpha0
java-1.8.0-alpha0
node-v0.*
node-v0.3.0
node-v0.3.1
node-v1.*
node-v1.0.0
node-v1.0.0-rc0
node-v1.0.0-rc1.0
node-v1.0.0-rc2.0
node-v1.0.0-rc3.0
node-v1.0.1
node-v1.1.0
node-v1.2.0
node-v1.2.1
node-v1.2.2
node-v1.2.3
node-v1.2.4
node-v1.2.5
node-v1.2.6
node-v1.2.7
node-v2.*
node-v2.0.0
node-v2.0.0-beta.0
node-v2.0.0-beta.3
node-v2.0.0-beta.4
node-v2.1.0
node-v2.2.0
node-v2.2.0-alpha.0
node-v2.2.0-alpha.1
node-v2.2.0-alpha.2
node-v2.2.0-alpha.3
node-v2.2.0-alpha.4
node-v2.2.0-alpha.5
node-v2.2.0-alpha.6
node-v2.2.1
node-v2.3.0
node-v2.4.0
node-v2.4.0-alpha.0
node-v2.4.0-alpha.1
node-v2.4.0-alpha.2
node-v2.5.0
node-v2.6.0
node-v2.6.0-alpha.0
node-v2.7.0
node-v2.7.0-alpha.0
node-v2.7.1
node-v2.8.0
node-v2.8.0-alpha.0
node-v2.9.0
node-v6.*
node-v6.0.0
node-v6.0.0-alpha.2
node-v6.0.0-alpha.3
node-v6.0.1
pymongocrypt-0.*
pymongocrypt-0.1b0
pymongocrypt-0.1b1
pymongocrypt-0.1b2
pymongocrypt-0.1b3
pymongocrypt-1.*
pymongocrypt-1.0.0
pymongocrypt-1.0.1
pymongocrypt-1.1.0
pymongocrypt-1.1.0b0
pymongocrypt-1.1.1
pymongocrypt-1.1.2
pymongocrypt-1.10.0
pymongocrypt-1.10.1
pymongocrypt-1.11.0
pymongocrypt-1.12.0
pymongocrypt-1.12.1
pymongocrypt-1.12.2
pymongocrypt-1.12.2rc1
pymongocrypt-1.12.2rc2
pymongocrypt-1.12.2rc4
pymongocrypt-1.13.0
pymongocrypt-1.14.0
pymongocrypt-1.14.1
pymongocrypt-1.15.0
pymongocrypt-1.15.1
pymongocrypt-1.16.0
pymongocrypt-1.17.0
pymongocrypt-1.18.0
pymongocrypt-1.18.0.dev0
pymongocrypt-1.18.1
pymongocrypt-1.2.0
pymongocrypt-1.2.2rc0
pymongocrypt-1.3.0
pymongocrypt-1.3.0b0
pymongocrypt-1.3.1
pymongocrypt-1.4.0
pymongocrypt-1.4.1
pymongocrypt-1.5.0
pymongocrypt-1.5.1
pymongocrypt-1.5.2
pymongocrypt-1.6.0
pymongocrypt-1.6.1
pymongocrypt-1.7.0
pymongocrypt-1.8.0
pymongocrypt-1.9.0
pymongocrypt-1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84962.json"