Libmongocrypt
Monthly
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Input injection in MongoDB libmongocrypt's automatic-encryption context setup permits caller-supplied database and collection name arguments containing '.' or NUL bytes to pass without sanitization, causing incorrect schema selection during Client-Side Field Level Encryption (CSFLE) operations. Affected callers - those with local access and low privileges - may obtain limited unauthorized disclosure or modification of data processed under the wrong encryption schema. No public exploit code exists and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.0 reflects the constrained real-world impact.
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Input injection in MongoDB libmongocrypt's automatic-encryption context setup permits caller-supplied database and collection name arguments containing '.' or NUL bytes to pass without sanitization, causing incorrect schema selection during Client-Side Field Level Encryption (CSFLE) operations. Affected callers - those with local access and low privileges - may obtain limited unauthorized disclosure or modification of data processed under the wrong encryption schema. No public exploit code exists and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.0 reflects the constrained real-world impact.
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.