CVE-2026-84962
Awaiting Analysis Awaiting Analysis - Queue

Arbitrary Authenticated Google Cloud KMS API Calls via Key Vault Write Access

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: MongoDB, Inc.

Description
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84962
EUVD
EUVD-2026-70516

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthorized user with write access to a key vault to trick an authorized client into making arbitrary Google Cloud KMS API calls under the authorized user's identity. This effectively lets the unauthorized user gain control over cloud key management and bypass client-side encryption.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data, manipulation of encryption keys, and potential data breaches. It escalates database-level access into broader cloud key control, compromising data security.

Compliance Impact

This vulnerability could result in non-compliance with data protection regulations like GDPR and HIPAA due to unauthorized access to sensitive data and potential data breaches. It undermines encryption controls required by these standards.

Mitigation Strategies

Restrict key vault write access to authorized users only and review access controls for Google Cloud KMS API calls to prevent unauthorized issuance of authenticated requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart