{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/compass--1.53.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":5.4,"id":"CVE-2026-114643"},{"cvss":5.9,"id":"CVE-2026-114644"},{"cvss":5.2,"id":"CVE-2026-114645"},{"id":"CVE-2026-114646"},{"id":"CVE-2026-114647"},{"cvss":7.6,"id":"CVE-2026-114648"},{"cvss":6.8,"id":"CVE-2026-114649"},{"id":"CVE-2026-114650"},{"id":"CVE-2026-114651"},{"id":"CVE-2026-114652"},{"id":"CVE-2026-114653"},{"id":"CVE-2026-114654"},{"id":"CVE-2026-114655"},{"id":"CVE-2026-115929"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["C Driver (\u003c 2.5.7, \u003c 1.30.14)","C# Driver (\u003c 3.13.0)","Compass (\u003c 1.53.1)","libmongocrypt (\u003c 1.21.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","mongodb","rce","injection"],"_cs_type":"advisory","_cs_vendors":["MongoDB"],"content_html":"\u003cp\u003eThe French National Cybersecurity Agency (ANSSI) has reported multiple vulnerabilities affecting several MongoDB software products, including C and C# drivers, MongoDB Compass, and libmongocrypt. These flaws collectively enable attackers to achieve arbitrary code execution, unauthorized data access, data corruption, and various injection-based attacks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe identified vulnerabilities can result in arbitrary code execution, compromise of data confidentiality and integrity, denial of service, CSRF, and SQL injection. The impact is significant for applications relying on affected MongoDB drivers or administrative tools like Compass.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all environments using MongoDB C Driver, C# Driver, MongoDB Compass, and libmongocrypt.\u003c/li\u003e\n\u003cli\u003eUpgrade MongoDB C Driver to version 2.5.7 or higher, or 1.30.14 or higher, depending on the branch.\u003c/li\u003e\n\u003cli\u003eUpgrade MongoDB C# Driver to version 3.13.0 or higher.\u003c/li\u003e\n\u003cli\u003eUpgrade MongoDB Compass to version 1.53.1 or higher.\u003c/li\u003e\n\u003cli\u003eUpgrade libmongocrypt to version 1.21.1 or higher.\u003c/li\u003e\n\u003cli\u003eRefer to the individual MongoDB Jira issue trackers for each specific CVE for detailed remediation guidance provided by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T22:20:52Z","date_published":"2026-10-26T22:20:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/","summary":"Multiple vulnerabilities across MongoDB drivers and tools expose systems to arbitrary code execution, data integrity and confidentiality loss, denial of service, and injection attacks.","title":"MongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.)","url":"https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/"}],"language":"en","title":"CraftedSignal Threat Feed - Compass (\u003c 1.53.1)","version":"https://jsonfeed.org/version/1.1"}