EUVD-2026-70516Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires key vault write privileges (PR:H), victim client action (UI:R), and attack complexity is high (AT:P maps to AC:H); scope changes to GCP KMS plane (S:C) with high confidentiality impact on key material only.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
AnalysisAI
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (cpe:2.3:a:mongodb:libmongocrypt:*), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have write access to the MongoDB key vault collection, which is a highly privileged database-level position (PR:H in CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:P, score 5.7) accurately models this as a moderate-severity, multi-prerequisite attack: the adversary must hold key vault write access (PR:H), a specific system prerequisite must be satisfied (AT:P), and the authorized client must actively trigger a cryptographic operation while malicious data is in place (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Monitor MongoDB JIRA MONGOCRYPT-960 (https://jira.mongodb.org/browse/MONGOCRYPT-960) for a patched libmongocrypt release and apply it by updating the MongoDB driver to the version that bundles the fixed library. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Libmongocrypt
View allA specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server
Input injection in MongoDB libmongocrypt's automatic-encryption context setup permits caller-supplied database and colle
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today