TLS Client Certificate Validation Issue in MongoDB C# Driver

CVE-2026-114649

What is CVE-2026-114649?

The MongoDB C# Driver contains a vulnerability in the way it validates TLS client certificates. Specifically, it relies only on the issuer and serial number for certificate matching when establishing cached connections. This allows an attacker to create a certificate that resembles another user's certificate by copying its issuer and serial number. Consequently, this could allow the attacker to gain access to database operations under the impersonated user’s credentials, thus compromising the confidentiality and integrity of sensitive data accessible to that user.

References