What’s Vulnerable › Vulnerabilities

CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-23
• Weakness: CWE-1025

Description

The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

Affected products

• MongoDB C# Driver: from 1.8.0 before 3.13.0 — fixed in 3.13.0

How to fix

Upgrade to a fixed version: MongoDB C# Driver 3.13.0. Check the vendor advisory for mitigations.

References

• https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
• https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-6gjm-424r-3jh2
• https://jira.mongodb.org/browse/CSHARP-6184

Get alerted when CVE-2026-114649 or the next vulnerability affects your stack