TLS Certificate Mismanagement in DB Tools by MongoDB
CVE-2026-116641

7.6HIGH

Key Information:

Vendor

Mongodb
Status
Database Tools
Vendor
CVE Published:
28 October 2026

What is CVE-2026-116641?

A vulnerability exists in MongoDB's DB Tools related to the handling of TLS certificates. The tools rely on the Golang standard library's TLS implementation, which utilizes the system's CA store. However, a specific version of Golang, 1.26.8, does not incorporate a critical internal denylist featuring known-bad CA certificates, notably eMudhra certificates. This limitation poses a risk for secure communications. This issue is effectively addressed in version 100.20.0 of DB Tools, which is compiled with Golang 1.27.3, thereby enhancing the application's certificate validation mechanisms.

Affected Version(s)

Database Tools 0 < 100.20.0

References

https://www.mongodb.com/docs/database-tools/release-notes...

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.