Vulnerability in libmongocrypt Affects Key Management Operations by MongoDB

CVE-2026-114655

What is CVE-2026-114655?

The libmongocrypt library is vulnerable due to improper validation and encoding of values inserted into requests for external key management services such as AWS, Azure, and GCP. Users with write access to the key vault can manipulate request structures, potentially leading to unauthorized key management operations. This may allow unintended actions to be performed using the application's credentials, raising significant security concerns. For details and mitigation strategies, please refer to the relevant resources.

References