CVE-2026-115929
HIGH 7.6MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
Severe if exploited (CVSS 7.6), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 8th percentile
Impact if exploited
7.6CVSS 4.0 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: Succeeds with passive user activity
- ⚠Complexity: Needs a race window or specific setup
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-295: Improper certificate validation
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- HIGH 7.6 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - MEDIUM 6.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - HIGH 7.6 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - MEDIUM 6.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109208 EUVD · EUVD-2026-109208
Technical & other
- https://github.com/mongodb-js/compass/releases/tag/v1.53.1CVE record · mongodb · Updated 2026-10-24T00:53:04.619Z
NVD · CVE-2026-115929 · Updated 2026-10-24T01:17:08.250 - https://releases.electronjs.org/release/v44.9.1CVE record · mongodb · Updated 2026-10-24T00:53:04.619Z
NVD · CVE-2026-115929 · Updated 2026-10-24T01:17:08.250 - https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/CVE record · mongodb · Updated 2026-10-24T00:53:04.619Z
NVD · CVE-2026-115929 · Updated 2026-10-24T01:17:08.250