CVE-2026-115930
Awaiting Analysis Awaiting Analysis - Queue

MongoDB Shell TLS Root Certificate Store Vulnerability

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: MongoDB, Inc.

Description
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115930
EUVD
EUVD-2026-109932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MongoDB, Inc. mongosh 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the MongoDB Shell (mongosh) using Node.js as a runtime with a TLS root certificate store that includes recoverable eMudhra intermediate CA certificates. It affects versions prior to 2.14.0 and is resolved by updating to mongosh 2.14.0 or later, which bundles Node.js 24.22.1 or newer.

Detection Guidance

To detect this vulnerability, check the installed version of MongoDB Shell (mongosh) using the command mongosh --version. If the version is prior to 2.14.0, the system is vulnerable.

Impact Analysis

The vulnerability could allow attackers to intercept encrypted communications due to the presence of compromised intermediate CA certificates in the TLS store. This may lead to man-in-the-middle attacks, data breaches, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential data breaches or unauthorized access to personal or health information. Organizations may face legal penalties, reputational damage, and loss of trust if such incidents occur.

Mitigation Strategies

Update MongoDB Shell (mongosh) to version 2.14.0 or later. If installed via npm, also update the host's Node.js runtime to version 24.22.1 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart