MongoDB Database Tools CVE-2026-116641

Exploitation requires (1) an attacker-controlled man-in-the-middle position on the network path between DB Tools and the MongoDB server, and (2) a TLS certificate chaining to the eMudhra CA that the newer Go denylist distrusts but the 100.19.0 build (Go 1.26.8) still accepts, valid for the targeted hostname. The victim must actively run an affected DB Tools version (prior to 100.20.0) to initiate a TLS connection (passive user interaction, UI:P). Limiting factors: the flaw affects only builds before 100.20.0; it does not apply to connections already protected by pinning or a restricted CA set, and the attacker gains nothing without both the interception position and a usable eMudhra-issued certificate.

This is a certificate-validation weakness (CWE-295): MongoDB DB Tools 100.19.0 was compiled with Golang 1.26.8, whose crypto/x509 denylist predates the addition of the distrusted eMudhra CA certificates, so the tools will trust TLS certificates chaining to that known-bad CA. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N) is internally consistent with this: network reachable but with elevated attack complexity and a specific attack requirement (AT:P) plus passive user interaction (UI:P) - i.e. the attacker needs a man-in-the-middle position AND a usable eMudhra-issued certificate, while a victim must initiate a TLS connection with the tool. That combination makes this a real-but-conditional issue rather than a trivially wormable one. No EPSS score, no KEV listing and no POC reference are present in the input - only the vendor changelog - so there is no signal of active or automated exploitation; the vuln.today priority is 'this_week' (patch promptly, not an emergency). Net: a legitimate confidentiality/integrity exposure for TLS-protected MongoDB connections that depends on the attacker already holding network position and a distrusted-CA certificate, which bounds real-world risk below the raw 7.6 severity.

An attacker positioned to intercept traffic (rogue Wi-Fi, compromised gateway, or hijacked DNS/BGP) presents a TLS certificate that chains to the distrusted eMudhra CA while a victim runs DB Tools 100.19.0 (built with Go 1.26.8) to connect to a MongoDB endpoint over TLS. Because the older Go build lacks the eMudhra denylist entry, the tool accepts the certificate, letting the attacker decrypt or modify the session and harvest database credentials and data. No public exploit identified at time of analysis.