MongoDB Compass EUVD-2026-109208

Exploitation requires three concrete prerequisites: (1) the attacker must be able to issue or possess a TLS certificate chained to one of the compromised recoverable eMudhra intermediate CA certificates; (2) the attacker must occupy a man-in-the-middle position on the network path between MongoDB Compass and the server it connects to (reflected as AT:P in the vector); and (3) a user must actively initiate a Compass connection over that attacker-controlled path (UI:P). Exploitation is limited to Compass versions prior to 1.53.1 (which still embed the vulnerable Electron trust store); the trigger mechanism beyond the trusted compromised CA is not further described in the available sources. The vendor states the issue is resolved by updating to Compass 1.53.1 (Electron 44.9.1); no alternative mitigation is given in the evidence.

This is a genuine but conditional risk, not an emergency. The flaw (CWE-295, improper certificate validation) stems from MongoDB Compass bundling Electron, whose TLS root store still trusted the recoverable eMudhra intermediate CA certificates that were compromised (per the referenced Mozilla security blog of 2026-10-20). The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VC:H/VI:H, score 7.6) is internally consistent with a man-in-the-middle scenario: network reachable but requiring a specific attack prerequisite (AT:P - the attacker must hold/abuse the compromised CA) and user interaction (UI:P - a user must initiate a Compass connection), yielding high confidentiality and integrity impact with no availability impact. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no public evidence of active exploitation. No proof-of-concept specific to Compass was supplied - the Mozilla reference documents the underlying CA compromise, not a working exploit against Compass. The vuln.today Decision label is 'this_week,' which aligns with a real-but-not-critical priority: patch within the week. Bottom line: the attack requires a privileged network position plus abuse of the compromised eMudhra chain, which bounds realistic exploitation to targeted interception rather than mass exploitation.

An attacker able to intercept a user's network traffic (e.g. on a hostile Wi-Fi network or via upstream network control) uses a fraudulent certificate signed by the compromised eMudhra intermediate CA to impersonate a MongoDB endpoint that Compass connects to. Because the bundled Electron runtime still trusts that CA, Compass accepts the forged certificate and the attacker transparently intercepts or modifies the TLS session. No public exploit specific to Compass was identified at time of analysis; exploitation also depends on the user initiating the connection (UI:P).