Database Tools
Monthly
MongoDB Database Tools builds prior to 100.20.0 (specifically 100.19.0, compiled with Golang 1.26.8) will accept TLS server certificates chaining to the eMudhra CA, which Go's crypto/x509 denylist only began rejecting in Golang 1.27.3. An attacker holding a man-in-the-middle position on the network path and a usable eMudhra-issued certificate for the targeted hostname could therefore intercept DB Tools connections to a MongoDB server and read or alter traffic; the victim must actively initiate the connection. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the flaw is resolved in DB Tools 100.20.0.
MongoDB Database Tools builds prior to 100.20.0 (specifically 100.19.0, compiled with Golang 1.26.8) will accept TLS server certificates chaining to the eMudhra CA, which Go's crypto/x509 denylist only began rejecting in Golang 1.27.3. An attacker holding a man-in-the-middle position on the network path and a usable eMudhra-issued certificate for the targeted hostname could therefore intercept DB Tools connections to a MongoDB server and read or alter traffic; the victim must actively initiate the connection. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the flaw is resolved in DB Tools 100.20.0.