MongoDB Rust Driver CVE-2025-11695

Exploitation requires that the affected application constructs a MongoDB connection string containing the literal option tlsInsecure=False (a non-default, deliberately-set value) on MongoDB Rust Driver versions prior to v3.2.5; this is the exact trigger that erroneously disables certificate validation. Beyond that configuration, the attacker must also hold an active man-in-the-middle position on the network path between the driver and the MongoDB server to present a forged certificate - without interception capability the flaw is latent. Limiting factors: it does not affect default configurations (which are unaffected or correctly validate), requires the specific inverted option to be present, and requires network interception, which together substantially narrow real-world exploitability despite the network attack vector.

This is a certificate-validation bypass (CWE-295) in the MongoDB Rust Driver caused by an inverted boolean: supplying tlsInsecure=False in a connection string - the setting a security-conscious operator would use to REQUIRE validation - instead disables it. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N, 7.5) rates this network-reachable and low-complexity, but this is misleading: realistic exploitation requires an active man-in-the-middle position on the network path between the driver and the MongoDB server, which is better modeled as AC:H, so the raw 'low complexity / network' framing overstates ease of attack. Exploitation signals are weak-to-moderate: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is real but conditional: it matters only where operators explicitly set tlsInsecure=False (expecting hardened TLS) AND an attacker can intercept traffic; absent both, exposure is low. Note a signal conflict worth flagging to the vendor: CVSS sets C:N (no confidentiality impact) yet the assigned Tag is 'Information Disclosure' and a TLS MITM inherently exposes credentials and query data - the C:N rating appears understated. Treat as a medium-urgency patch priority, not an emergency.

An operator hardens a Rust service by adding tlsInsecure=False to the MongoDB connection string, believing this enforces certificate validation, but the driver silently accepts any certificate. An attacker positioned on the network (e.g., ARP spoofing, rogue gateway, or compromised intermediary) presents a forged certificate, completes the TLS handshake, and transparently intercepts and alters database traffic including authentication credentials and query results. No public exploit code is known, but the MITM technique required is standard and well-understood.