Live › vulnerability › CVE-2026-114649
Go to dashboardThe MongoDB C# Driver decides whether two clients can share cached connections by comparing only a TLS client certificate's issuer and serial number. An attacker who copies another user's issuer and serial number, without the private key, can get connections authenticated as that other user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use the MongoDB C# Driver with TLS client certificates and create clients from certificates supplied by different users, so that cached connections can be shared between them. Applications that use a single trusted certificate, or that do not use client certificate authentication, are unlikely to be exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.
This page as .md · .json · in your agent: get_signal("CVE-2026-114649")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.