Skip to content
Threat Feed
Subscribe
high advisory

MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.)

Multiple vulnerabilities across MongoDB drivers and tools expose systems to arbitrary code execution, data integrity and confidentiality loss, denial of service, and injection attacks.

CVE search metadata

CVE search record: CVE-2026-114643. Severity: medium. CVSS: 5.4. EPSS: 0.37%. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114644. Severity: medium. CVSS: 5.9. EPSS: 0.48%. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114645. Severity: medium. CVSS: 5.2. EPSS: 0.17%. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114646. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114647. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114648. Severity: high. CVSS: 7.6. EPSS: 0.32%. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114649. Severity: medium. CVSS: 6.8. EPSS: 0.20%. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114650. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114651. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114652. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114653. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114654. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-114655. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

CVE search record: CVE-2026-115929. KEV: no. Product: C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0), Compass (< 1.53.1), libmongocrypt (< 1.21.1). Brief: MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/

Triage facts

Revision 1
Applicability
C Driver (< 2.5.7, < 1.30.14), C# Driver (< 3.13.0) +2
Evidence
Unknown
Severity
High
Action
Elevated
Sources
29 public sources
Freshness
Revision 1Oct 26, 22:20 UTC
Vulnerabilities
14 CVEs
Source quality
A1Likely

The French National Cybersecurity Agency (ANSSI) has reported multiple vulnerabilities affecting several MongoDB software products, including C and C# drivers, MongoDB Compass, and libmongocrypt. These flaws collectively enable attackers to achieve arbitrary code execution, unauthorized data access, data corruption, and various injection-based attacks.

Impact

The identified vulnerabilities can result in arbitrary code execution, compromise of data confidentiality and integrity, denial of service, CSRF, and SQL injection. The impact is significant for applications relying on affected MongoDB drivers or administrative tools like Compass.

Recommendation

  • Inventory all environments using MongoDB C Driver, C# Driver, MongoDB Compass, and libmongocrypt.
  • Upgrade MongoDB C Driver to version 2.5.7 or higher, or 1.30.14 or higher, depending on the branch.
  • Upgrade MongoDB C# Driver to version 3.13.0 or higher.
  • Upgrade MongoDB Compass to version 1.53.1 or higher.
  • Upgrade libmongocrypt to version 1.21.1 or higher.
  • Refer to the individual MongoDB Jira issue trackers for each specific CVE for detailed remediation guidance provided by the vendor.

Immediate actions

Inventory MongoDB drivers and Compass installations to identify vulnerable versions.

IT Operations 48h

Mitigations

Upgrade to identified safe versions: C Driver 2.5.7/1.30.14, C# Driver 3.13.0, Compass 1.53.1, libmongocrypt 1.21.1.

immediate IT Operations

All identified vulnerable MongoDB products