CVE-2026-115929: MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-24 · updated 2026-10-26
Weakness: CWE-295

Description

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

Affected products

MongoDB Compass: before 1.53.1 — fixed in 1.53.1

How to fix

Upgrade to a fixed version: MongoDB Compass 1.53.1. Check the vendor advisory for mitigations.

References

https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/
https://github.com/mongodb-js/compass/releases/tag/v1.53.1
https://releases.electronjs.org/release/v44.9.1

Get alerted when CVE-2026-115929 or the next vulnerability affects your stack