CVE-2026-114655— KMS request injection via unsanitized key vault and provider values in libmongocrypt
Quick assessment
Affected
MongoDB libmongocrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libmongocrypt 在构建发往外部密钥管理服务（AWS、Azure 和 GCP）的请求时，会将密钥保险库文档、KMS 提供者配置以及 KMS 响应中的值直接插入到请求行、请求头和已签名的请求体中，但未针对各自上下文对这些值进行验证或编码。拥有密钥保险库集合写入权限的用户可以修改这些请求的结构，包括在请求体和令牌声明中添加成员，而该库随后会使用应用程序的凭据对这些内容进行签名。这可能导致密钥管理操作以应用程序未预期的参数被执行。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | libmongocrypt | 1.0.0< 1.21.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114655
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KMS request injection via unsanitized key vault and provider values in libmongocrypt
Source: CVE Program / CVE List V5
Vulnerability Description
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | libmongocrypt | 1.0.0 ~ 1.21.1 | - |
|
II. Public POCs for CVE-2026-114655
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114655
请登录查看更多情报信息。
Other References for CVE-2026-114655 (3)
Same Patch Batch · MongoDB · 2026-10-22 · 13 CVEs total
| CVE-2026-114648 | 7.6 HIGH | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary ke |
| CVE-2026-114649 | 6.8 MEDIUM | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster ca |
| CVE-2026-114652 | 6.5 MEDIUM | Update operator injection via single-element list rewriting in the update builder |
| CVE-2026-114646 | 6.5 MEDIUM | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire |
| CVE-2026-114654 | 6.5 MEDIUM | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards |
| CVE-2026-114653 | 6.5 MEDIUM | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builde |
| CVE-2026-114650 | 5.9 MEDIUM | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name |
| CVE-2026-114644 | 5.9 MEDIUM | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deseri |
| CVE-2026-114643 | 5.4 MEDIUM | Duplicate geometry fields via unvalidated GeoJSON extra members |
| CVE-2026-114645 | 5.2 MEDIUM | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message |
| CVE-2026-114647 | 4.3 MEDIUM | NoSQL operator injection via unvalidated replacement document in findOneAndReplace |
| CVE-2026-114651 | 4.0 MEDIUM | Cross-document data leak via malformed BSON array parsing in reused thread buffer |
IV. Related Vulnerabilities
Same product: libmongocrypt
-
CVE-2026-106434
Unrecognized payload acceptance in explicit decryption in Mo -
CVE-2026-106433
Heap corruption via duplicate masterKey fields in MongoDB li -
CVE-2026-106429
Application denial of service via malformed KMS endpoint in -
CVE-2026-84962
Authenticated KMS request forgery via CRLF injection in GCP -
CVE-2026-84971
Persistent client crash loop via undersized FLE2 insert-upda
Same vendor: MongoDB
-
CVE-2026-114654
BSON output corruption via out-of-range binary subtype bypas -
CVE-2026-114653
Silent client-side encryption bypass via unescaped field-nam -
CVE-2026-114652
Update operator injection via single-element list rewriting -
CVE-2026-114651
Cross-document data leak via malformed BSON array parsing in -
CVE-2026-114650
Plaintext exposure of encrypted fields via ANSI code-page co
Same weakness: CWE-74
-
CVE-2026-76473
Cisco Unified Communications Products Hardening Release: Oct -
CVE-2026-112183
MISP CSS Injection via Remote Tag Colour in Event Preview -
CVE-2026-111223
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via -
CVE-2026-55453
CUPS ipp backend status-line injection can update queue PPD -
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery
V. Comments for CVE-2026-114655
No comments yet