> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # MongoDB drivers and Compass face multiple critical vulnerabilities including RCE and SQLi - URL: https://f4n6.co.uk/security-feed/mongodb-drivers-and-compass-face-multiple-critical-vulnerabilities-including-rce-and-sqli/ - Published: 2026-10-26T18:36:43.000Z - Updated: 2026-10-26T18:36:43.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-114643, CVE-2026-114644, CVE-2026-114645, CVE-2026-114646, CVE-2026-114647 ## 1\. Executive summary CERT-FR published an advisory on 26 October 2026 covering multiple vulnerabilities in MongoDB products: the C Driver, the C# Driver, Compass and libmongocrypt. The affected ranges are C Driver 2.5.x before 2.5.7 and C Driver before 1.30.14, C# Driver before 3.13.0, Compass before 1.53.1 and libmongocrypt before 1.21.1\. The ten CVEs with NVD records in scope carry CVSS scores from 5.3 to 8.2, with four rated HIGH (CVE-2026-114644 at 8.2, CVE-2026-114649 at 7.6, CVE-2026-114648 at 7.2 and CVE-2026-114652 at 7.1); none is in CISA KEV and all show EPSS of 0%. CERT-FR lists arbitrary code execution, data confidentiality and integrity impact, security policy bypass, denial of service, CSRF and SQL injection among the possible outcomes. For EMEA financial services the exposure is concentrated in application and data-platform teams that embed these drivers in payment, reconciliation or reporting services, and in developer workstations running Compass against production-adjacent clusters. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain CERT-FR does not publish a per-CVE mechanism breakdown. The advisory names the affected products and version ranges, the risk categories, and links to thirteen MongoDB Jira tickets and one GitHub release. The CVE-to-ticket mapping is not stated in the source, so the table below pairs each CVE with its NVD weakness classification only and does not assert which product or ticket it belongs to. | CVE | CVSS | Severity | CWE | KEV | EPSS | | --------------- | ---- | -------- | ------------------------------------------------------------ | --- | ---- | | CVE-2026-114644 | 8.2 | HIGH | CWE-770 Allocation of Resources Without Limits or Throttling | No | 0% | | CVE-2026-114649 | 7.6 | HIGH | CWE-1025 | No | 0% | | CVE-2026-114648 | 7.2 | HIGH | CWE-943 | No | 0% | | CVE-2026-114652 | 7.1 | HIGH | CWE-943 | No | 0% | | CVE-2026-114646 | 6.9 | MEDIUM | CWE-130 | No | 0% | | CVE-2026-114650 | 6.9 | MEDIUM | CWE-838 | No | 0% | | CVE-2026-114651 | 6.3 | MEDIUM | CWE-908 Use of Uninitialized Resource | No | 0% | | CVE-2026-114645 | 5.7 | MEDIUM | CWE-190 Integer Overflow or Wraparound | No | 0% | | CVE-2026-114643 | 5.3 | MEDIUM | CWE-694 | No | 0% | | CVE-2026-114647 | 5.3 | MEDIUM | CWE-943 | No | 0% | CERT-FR also lists CVE-2026-114653, CVE-2026-114654, CVE-2026-114655 and CVE-2026-115929 in its documentation. No NVD record, CVSS score or weakness classification for those four appears in the data available to this advisory, so they are named here without a rating. The weakness classes that carry the most weight for a defender are the three CWE-943 entries (CVE-2026-114647, CVE-2026-114648, CVE-2026-114652). CWE-943 is improper neutralisation of special elements in data query logic, the class behind injection flaws. CERT-FR separately lists SQL injection and CSRF among the risks, which is consistent with a query-construction weakness in a driver that builds database operations from application-supplied input. CVE-2026-114644 (CWE-770) describes resource allocation without limits, the pattern behind a denial of service where a caller can drive unbounded memory or connection growth. CVE-2026-114645 (CWE-190) and CVE-2026-114651 (CWE-908) are memory-safety classes that in a C driver can lead to out-of-bounds access or use of uninitialised data. CVE-2026-114649 carries CWE-1025, which NVD does not expand in the data available here; treat its mechanism as uncharacterised. The attack chain below is limited to what the source supports. CERT-FR gives no exploitation steps, no proof-of-concept detail and no observed in-the-wild activity. 1. An application embeds an affected driver version (C Driver before 2.5.7 on the 2.5.x line, C Driver before 1.30.14 on the 1.x line, C# Driver before 3.13.0, or libmongocrypt before 1.21.1), or a developer runs Compass before 1.53.1. 2. An attacker supplies input that reaches the vulnerable code path. CERT-FR does not describe the input or the path for any individual CVE. 3. Depending on the CVE, the outcome is arbitrary code execution, data confidentiality or integrity impact, security policy bypass, denial of service, CSRF or SQL injection, per the risk list in the CERT-FR advisory. No actor is named in the source and no MITRE ATT&CK profile applies. There is no attribution to report and none should be inferred. The practical exposure is supply-chain shaped. These are client libraries and a desktop GUI, not a server. A bank's own code, or a vendor product that bundles the driver, inherits the flaw. Compass is a developer tool that holds saved connection strings and credentials for clusters; a flaw in Compass before 1.53.1 sits on engineering workstations that often reach production-adjacent environments. libmongocrypt handles field-level encryption, so a flaw there touches the code path that protects encrypted fields rather than the data at rest. Confidence caveat: the entire technical picture rests on a single source, the CERT-FR advisory, plus the NVD, EPSS and CISA KEV records for ten of the fourteen CVEs. CERT-FR does not map CVEs to products or to its Jira tickets, and the MongoDB Jira tickets were not retrieved for this advisory. Verify the per-CVE product mapping against the MongoDB tickets before scoping remediation to a specific component. ## 4\. Mitigation & containment P1 within 24h - Inventory every application and vendor product that links the MongoDB C Driver, C# Driver or libmongocrypt, and every workstation with Compass installed. Check the resolved version, not the manifest: for .NET run `dotnet list package --include-transitive` and look for MongoDB.Driver below 3.13.0; for C and C++ check the linked libmongoc/libbson version against 2.5.7 and 1.30.14; for libmongocrypt check against 1.21.1. - Upgrade Compass to 1.53.1 or later on all developer endpoints. Compass before 1.53.1 is the only affected product that is a standalone desktop application and the fastest to remediate. - Where an affected driver cannot be upgraded within 24h, identify the code paths that pass externally supplied input into query construction and add input validation at that boundary. This is a stopgap, not a fix. P2 within 72h - Upgrade the C# Driver to 3.13.0 or later, the C Driver to 2.5.7 (2.5.x line) or 1.30.14 (1.x line), and libmongocrypt to 1.21.1 or later. Rebuild and redeploy dependent services; a driver bump requires a recompile, not just a package restore. - Ask third-party vendors whose products embed these drivers for their patched build and their CVE mapping. The driver is frequently bundled and invisible in a standard SBOM unless transitive dependencies are captured. - For the CWE-770 entry (CVE-2026-114644), review connection pool and memory limits on services that accept untrusted input, so an unbounded-allocation path is bounded by configuration even before the patch lands. P3 within 7 days - Add the MongoDB drivers and Compass to the SBOM and dependency-scanning baseline so future driver CVEs surface automatically. - Review Compass saved connections on engineering endpoints and confirm none carries production credentials beyond what the role needs. No vendor workaround beyond upgrading is given in the source. CERT-FR directs readers to the MongoDB security bulletins for patches. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The CERT-FR advisory lists affected version ranges and CVE identifiers, not atomic indicators, and no exploitation activity is described. ## 6\. Detection Insufficient indicators to author detection rules. The source gives version ranges and CVE identifiers only. Those are not artefacts of an attack and a rule built on them would detect reporting about the vulnerabilities, not exploitation. Detection here is version-based: query your asset and dependency inventory for the affected ranges in §4 rather than deploying a signature. ## CVE assessment 10 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ---------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-114644](https://nvd.nist.gov/vuln/detail/CVE-2026-114644?ref=f4n6.co.uk) | 8.2 High | — | 0% | The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of… | | [CVE-2026-114649](https://nvd.nist.gov/vuln/detail/CVE-2026-114649?ref=f4n6.co.uk) | 7.6 High | — | 0% | The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can s… | | [CVE-2026-114648](https://nvd.nist.gov/vuln/detail/CVE-2026-114648?ref=f4n6.co.uk) | 7.2 High | — | 0% | The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifier… | | [CVE-2026-114652](https://nvd.nist.gov/vuln/detail/CVE-2026-114652?ref=f4n6.co.uk) | 7.1 High | — | 0% | A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause ap… | | [CVE-2026-114646](https://nvd.nist.gov/vuln/detail/CVE-2026-114646?ref=f4n6.co.uk) | 6.9 Medium | — | 0% | A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application… | | [CVE-2026-114650](https://nvd.nist.gov/vuln/detail/CVE-2026-114650?ref=f4n6.co.uk) | 6.9 Medium | — | 0% | A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-leve… | | [CVE-2026-114651](https://nvd.nist.gov/vuln/detail/CVE-2026-114651?ref=f4n6.co.uk) | 6.3 Medium | — | 0% | A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previou… | | [CVE-2026-114645](https://nvd.nist.gov/vuln/detail/CVE-2026-114645?ref=f4n6.co.uk) | 5.7 Medium | — | 0% | A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized he… | | [CVE-2026-114643](https://nvd.nist.gov/vuln/detail/CVE-2026-114643?ref=f4n6.co.uk) | 5.3 Medium | — | 0% | The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members s… | | [CVE-2026-114647](https://nvd.nist.gov/vuln/detail/CVE-2026-114647?ref=f4n6.co.uk) | 5.3 Medium | — | 0% | The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndR… | ## 7\. Sources - ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits MongoDB" (CERTFR-2026-AVI-1386), 26 October 2026\. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1386/ - MongoDB, CDRIVER-6421 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CDRIVER-6421 - MongoDB, CSHARP-6157 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6157 - MongoDB, CSHARP-6162 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6162 - MongoDB, CSHARP-6166 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6166 - MongoDB, CSHARP-6168 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6168 - MongoDB, CSHARP-6170 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6170 - MongoDB, CSHARP-6174 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6174 - MongoDB, CSHARP-6179 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6179 - MongoDB, CSHARP-6180 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6180 - MongoDB, CSHARP-6181 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6181 - MongoDB, CSHARP-6184 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6184 - MongoDB, CSHARP-6186 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/CSHARP-6186 - MongoDB, MONGOCRYPT-963 security bulletin, 22 October 2026\. https://jira.mongodb.org/browse/MONGOCRYPT-963 - MongoDB, Compass v1.53.1 release, 24 October 2026\. https://github.com/mongodb-js/compass/releases/tag/v1.53.1 - NVD, EPSS and CISA KEV records for CVE-2026-114643 through CVE-2026-114652, as supplied. ## 8\. Adverse Trace position Adverse Trace assesses this as a medium-priority patch item, not an emergency. The highest CVSS in scope is 8.2 (CVE-2026-114644) and four CVEs are HIGH, but none is in CISA KEV, every EPSS score is 0%, and the source describes no exploitation. The risk is real for firms that ship these drivers in internet-facing or payment-path services, because a query-injection or memory-safety flaw in a driver is reachable wherever untrusted input reaches the database call, and because the driver is often a transitive dependency that never appears in a top-level manifest. The technical detail rests on a single source, CERT-FR, which does not map CVEs to products or tickets; we will retrieve the MongoDB Jira tickets and confirm the per-CVE product and version mapping, then reissue if the mapping changes the priority order. We will also check whether any EMEA client's third-party vendor products bundle the affected driver versions and flag those to the relevant vendor-risk owners. Clients should treat the version inventory in §4 as the action item this week and confirm Compass is off any endpoint that holds production credentials. --- [Read the original source →](https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1386/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*