EN PT-BR
← Voltar ao feed
high

CERT-FR flags multiple vulnerabilities in MongoDB drivers, Compass and libmongocrypt, including arbitrary code execution (CERTFR-2026-AVI-1386)

1 fonte(s) · 1 atualização(ões) · publicado 25/10/2026 21:00 · coletado há 4 dias

CERT-FR published advisory CERTFR-2026-AVI-1386 on multiple vulnerabilities in MongoDB products. Some of them allow an attacker to achieve arbitrary code execution, compromise data confidentiality and compromise data integrity. The advisory also lists security policy bypass and cross-site request forgery (CSRF) among the impacts. It covers the C Driver, C# Driver, Compass and libmongocrypt, and relies on MongoDB bulletins dated 22 to 24 October 2026. The advisory does not report active exploitation, CVSS scores or IOCs.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1386 covers 14 CVEs (CVE-2026-114643 to CVE-2026-114655 and CVE-2026-115929) in MongoDB products: the C Driver, C# Driver, Compass and libmongocrypt. The listed impacts are arbitrary code execution, loss of data confidentiality and integrity, security policy bypass and CSRF. The advisory does not link each impact to a CVE, give CVSS scores, or say what an attacker needs (network access, authentication, user interaction). Affected: C Driver 2.5.x before 2.5.7, C Driver before 1.30.14, C# Driver before 3.13.0, Compass before 1.53.1, libmongocrypt before 1.21.1. Fixed in those versions or later. No active exploitation is reported.

Como funciona

The advisory does not describe how any of these flaws work. It gives no input path, no vulnerable component and no step where processing goes wrong. It only lists the possible outcomes (code execution, confidentiality and integrity loss, policy bypass, CSRF) for the drivers, Compass and libmongocrypt. Defenders must read the MongoDB tickets for the mechanism of each CVE.

Por que é vulnerável

The articles give no root cause for any of the CVEs. The advisory only says the vendor fixes are in the listed versions and tells readers to follow the MongoDB security bulletins. It does not say why the flaws went unnoticed or what each fix changes.

Onde está

No file, function or commit is named. The advisory only points to MongoDB tickets CDRIVER-6421, CSHARP-6157, 6162, 6166, 6168, 6170, 6174, 6179, 6180, 6181, 6184, 6186, MONGOCRYPT-963 and the Compass v1.53.1 GitHub release.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published its advisory on 26 October 2026, based on MongoDB bulletins dated 22 October 2026 (drivers and libmongocrypt) and 24 October 2026 (Compass v1.53.1). The advisory reports no exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 14:23.

Detalhes técnicos

  • Affected: C Driver 2.5.x before 2.5.7; C Driver before 1.30.14; C# Driver before 3.13.0; Compass before 1.53.1; libmongocrypt before 1.21.1.
  • Tracked CVEs: CVE-2026-114643 to CVE-2026-114655 and CVE-2026-115929.
  • Impacts listed: arbitrary code execution, loss of confidentiality, loss of integrity, security policy bypass and CSRF. The advisory does not map each impact to a specific CVE and gives no root cause or attack vector.
  • Vendor references: MongoDB tickets CDRIVER-6421, CSHARP-6157, CSHARP-6162, CSHARP-6166, CSHARP-6168, CSHARP-6170, CSHARP-6174, CSHARP-6179, CSHARP-6180, CSHARP-6181, CSHARP-6184, CSHARP-6186, MONGOCRYPT-963, and the Compass v1.53.1 release.

Remediação

  • Apply the fixes described in the MongoDB security bulletins, as CERT-FR directs.
  • Upgrade to C Driver 2.5.7 or 1.30.14, C# Driver 3.13.0, Compass 1.53.1 and libmongocrypt 1.21.1 or later.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 25/10/2026 21:00 · coletado 28/10 14:01 primeiro registro

    CERT-FR flags multiple vulnerabilities in MongoDB drivers, Compass and libmongocrypt, including arbitrary code execution (CERTFR-2026-AVI-1386)

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1386 on multiple vulnerabilities in MongoDB products. Some of them allow an attacker to achieve arbitrary code execution, compromise data confidentiality and compromise data integrity. The advisory also lists security policy bypass and cross-site request forgery (CSRF) among the impacts. It covers the C Driver, C# Driver, Compass and libmongocrypt, and relies on MongoDB bulletins dated 22 to 24 October 2026. The advisory does not report active exploitation, CVSS scores or IOCs.

    Technical Details

    • Affected: C Driver 2.5.x before 2.5.7; C Driver before 1.30.14; C# Driver before 3.13.0; Compass before 1.53.1; libmongocrypt before 1.21.1.
    • Tracked CVEs: CVE-2026-114643 to CVE-2026-114655 and CVE-2026-115929.
    • Impacts listed: arbitrary code execution, loss of confidentiality, loss of integrity, security policy bypass and CSRF. The advisory does not map each impact to a specific CVE and gives no root cause or attack vector.
    • Vendor references: MongoDB tickets CDRIVER-6421, CSHARP-6157, CSHARP-6162, CSHARP-6166, CSHARP-6168, CSHARP-6170, CSHARP-6174, CSHARP-6179, CSHARP-6180, CSHARP-6181, CSHARP-6184, CSHARP-6186, MONGOCRYPT-963, and the Compass v1.53.1 release.

    Remediation

    • Apply the fixes described in the MongoDB security bulletins, as CERT-FR directs.
    • Upgrade to C Driver 2.5.7 or 1.30.14, C# Driver 3.13.0, Compass 1.53.1 and libmongocrypt 1.21.1 or later.