Which versions of MongoDB Compass are affected by CVE-2026-14881?

MongoDB Compass, a database management tool used by engineering teams across the organization, contains a critical command injection vulnerability (CVE-2026-14881, CVSS 8.4) that enables code…. A patch is available.

How to fix or mitigate CVE-2026-14881?

Within 24 hours, notify all database engineering teams of the vulnerability and direct them to avoid importing .json connection files from untrusted or unexpected sources; cross-reference recent imports with known-safe sources. Within 7 days, audit workstation logs for suspicious process execution from MongoDB Compass and review connection file sharing practices across teams and CI/CD pipelines. Within 30 days, prepare for rapid deployment of MongoDB Compass patches once available from the vendor, and evaluate restricting OIDC authentication in Compass as a temporary measure if exploitation concerns remain high.

MongoDB Compass CVE-2026-14881

Q: What is the CVSS score of CVE-2026-14881?

CVE-2026-14881 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-47781 HIGH

OS Command Injection (CWE-78)

2026-07-22 cna@mongodb.com

Command Injection

8.4

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local, no attacker privileges, but requires the victim to import a file and trigger OIDC (UI:R); resulting command execution yields high C/I/A on the local host with unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:37 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 8.4

DescriptionCVE.org

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

AnalysisAI

OS command injection in MongoDB Compass allows an attacker to smuggle a malicious 'browser open command' for the OIDC authentication flow into an importable connection file, a setting normally restricted to global Compass application settings and not editable through the connection form. When a victim imports the crafted connection and initiates OIDC authentication, the attacker-controlled command executes on the victim's host with the user's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 8.4 (High) reflecting full compromise of confidentiality, integrity, and availability of the local system.

Technical ContextAI

MongoDB Compass is the official GUI client for MongoDB, built on Electron. It supports OIDC (OpenID Connect) authentication, which requires launching a system browser to complete an interactive login; Compass exposes a configurable 'browser open command' for this purpose that is intended to be set only globally through application settings. The flaw is a CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: the connection import routine fails to filter out privileged/normally-inaccessible options, so the browser-open command - an OS command string - can be injected via an imported connection definition. Because that string is passed to the operating system to spawn a process during the OIDC flow, attacker-controlled content becomes an executed command. No CPE strings were supplied in the intelligence, so exact affected version ranges rely on the vendor release tag.

RemediationAI

Vendor-released patch: upgrade to MongoDB Compass v1.49.7 or later (release: https://github.com/mongodb-js/compass/releases/tag/v1.49.7). Until upgraded, do not import connection files from untrusted or unverified sources, since the malicious payload travels inside an imported connection definition. As a compensating control, organizations can restrict or disable use of the connection import feature via managed configuration where available, and avoid OIDC-authenticated connections created from imported files until each has been reviewed; the trade-off is reduced convenience for teams that legitimately share connection configurations. Users who suspect they imported an untrusted connection should inspect and remove any unexpected OIDC browser-open command in their global Compass settings.