AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MongoDBGHSA-j29g-r9cq-fh35

Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

MongoDB

CVE-2026-84962 · Published Sep 3, 2026

Medium5.7
Fix: upgrade to 1.20.2 or later
GitHub advisory

Impact

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Patches

Fixed in 1.20.2.

Workarounds

Validate the contents of the key vault collection.

References

https://jira.mongodb.org/browse/MONGOCRYPT-960

Affected versions

PackageAffectedFixed in
libmongocrypt
Product
< 1.20.21.20.2
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Severity from
GitHub (reviewed advisory)

More MongoDB advisories

All MongoDB
Medium 6.9Sep 3Heap out-of-bounds read via corrupt nested BSON in field path error messageCVE-2026-84968fixed in 1.21.8 +2High 7.1Sep 3Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption pathCVE-2026-84971fixed in 1.20.4Medium 5.9Sep 3BSON element injection via NUL-embedded document keys in builder appendCVE-2026-84966fixed in 4.5.2Medium 5.9Sep 3Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parserCVE-2026-84970fixed in 4.5.2Medium 6.3Sep 3Heap overflow via truncated base64 encoding of binary fields in length-limited JSON outputCVE-2026-84969fixed in 1.30.9 +1Medium 5.1Sep 3MongoDB for VS Code: command injectionCVE-2026-84967fixed in 1.17.1