Libmongocrypt (< 1.21.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/libmongocrypt--1.21.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 22:20:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoDB: Multiple product vulnerabilities (CVE-2026-114643 et al.)https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/Mon, 26 Oct 2026 22:20:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities-866b95d6/Multiple vulnerabilities across MongoDB drivers and tools expose systems to arbitrary code execution, data integrity and confidentiality loss, denial of service, and injection attacks.The French National Cybersecurity Agency (ANSSI) has reported multiple vulnerabilities affecting several MongoDB software products, including C and C# drivers, MongoDB Compass, and libmongocrypt. These flaws collectively enable attackers to achieve arbitrary code execution, unauthorized data access, data corruption, and various injection-based attacks.

Impact

The identified vulnerabilities can result in arbitrary code execution, compromise of data confidentiality and integrity, denial of service, CSRF, and SQL injection. The impact is significant for applications relying on affected MongoDB drivers or administrative tools like Compass.

Recommendation

  • Inventory all environments using MongoDB C Driver, C# Driver, MongoDB Compass, and libmongocrypt.
  • Upgrade MongoDB C Driver to version 2.5.7 or higher, or 1.30.14 or higher, depending on the branch.
  • Upgrade MongoDB C# Driver to version 3.13.0 or higher.
  • Upgrade MongoDB Compass to version 1.53.1 or higher.
  • Upgrade libmongocrypt to version 1.21.1 or higher.
  • Refer to the individual MongoDB Jira issue trackers for each specific CVE for detailed remediation guidance provided by the vendor.
]]>highadvisoryvulnerabilitymongodbrceinjection