PatchTheCVECVE-2026-114655: libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values fro
30
Routine
MEDIUM 5.9WATCHLIST
CVE-2026-114655 is a medium-severity flaw (CVSS 5.9) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 82%) |
| CISA exploited list | No |
| Weakness | CWE-74 |
| Published | 2026-10-22 |
| Last modified | 2026-10-23 |
Publisher (CNA): MongoDB, Inc.
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Fedora 46 · diffoscope · FIXED · 335-1.fc46 · FEDORA-2026-e4c4cc0856 · source
sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856
Debian 12 · libmongocrypt · NO FIX YET
Debian 13 · libmongocrypt · NO FIX YET
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.