MongoDB Shell CVE-2026-115930

Requires an attacker in an on-path/MITM network position who can present a server certificate chaining to one of the recoverable eMudhra intermediate CA certificates present in the Node.js TLS root store bundled with mongosh, AND a victim who initiates a mongosh TLS connection (UI:P passive interaction). Limiting factors: affects only mongosh versions prior to 2.14.0; npm-based installs instead depend on the host Node.js runtime version, so patching mongosh alone does not fix those unless the host Node.js is also updated; without the MITM position and usable certificates under the specified CA, default usage is not exploitable. The precise trigger mechanism beyond acceptance of the forged chain is not described in the available sources.

This is a certificate-validation flaw (CWE-295) rated CVSS 4.0 7.6 (High) with vector AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N. The network attack vector and PR:N (unauthenticated) raise the ceiling, but AC:H, AT:P (a specific attack requirement) and UI:P (passive user interaction) materially lower practical exploitability: an attacker needs an on-path/MITM position AND the ability to leverage the recoverable eMudhra intermediate CA certificates, and a victim must actually initiate a mongosh TLS connection. Impact is confidentiality and integrity High with availability None, consistent with traffic interception/tampering rather than service disruption. No EPSS score and no SSVC automatable value were provided, and there is no CISA KEV listing and no POC in the input, so there is no signal of active or widespread exploitation - this is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' indicating prompt but not emergency remediation. Net: a genuine High-severity MITM-class issue warranting timely patching, but the on-path and user-interaction prerequisites make mass, opportunistic exploitation unlikely; treat it as a prioritized-this-week fix rather than an emergency.

An on-path attacker presents a TLS server certificate that chains to a recoverable eMudhra intermediate CA still trusted in the Node.js root store bundled with mongosh; when an administrator runs mongosh to connect to MongoDB over TLS, the forged chain is accepted and the attacker can intercept and tamper with the session. The high attack complexity reflects the required MITM position plus access to usable certificates under that CA, and the passive user interaction is the victim simply initiating the connection. No public exploit identified at time of analysis.