CVE Feed

    Dashboard / CVE / CVE-2026-114649

    CVE-2026-114649

    The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

    Published:Oct 22, 2026
    Last Modified:Oct 23, 2026
    EPS:Oct 22, 2026
    EPSS Score:
    CVSS Score:6.8

    Affected Products

    Vendor
    Mongodb
    Product
    C# Driver

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-1025 Comparison Using Wrong Factors

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114654 (CVSS 6.9) — A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range bi…
    CVE-2026-114653 (CVSS 7.1) — A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field i…
    CVE-2026-114652 (CVSS 7.1) — A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Dr…
    CVE-2026-114651 (CVSS 6.3) — A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left …
    CVE-2026-114650 (CVSS 6.9) — A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for clien…
    CVE-2026-114648 (CVSS 7.2) — The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-…
    CVE-2026-114647 (CVSS 5.3) — The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar si…
    CVE-2026-114646 (CVSS 6.9) — A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. Whe…
    CVE-2026-114644 (CVSS 8.2) — The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserializa…
    CVE-2026-114643 (CVSS 5.3) — The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High