{"id":"CVE-2026-114649","kind":"vulnerability","aliases":["CVE-2026-114649"],"related":[],"title":"MongoDB C# Driver: shared connections can reuse another user's TLS identity","description":"The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.","summary":"The MongoDB C# Driver decides whether two clients can share cached connections by comparing only a TLS client certificate's issuer and serial number. An attacker who copies another user's issuer and serial number, without the private key, can get connections authenticated as that other user.","severity":"high","cvss":7.6,"epss":0.002,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c#","dotnet","mongodb","multi-tenant","package","tls-client-certificates"],"not_affected_if":["no-client-certificate-auth","single-certificate"],"how_to_check":"- Check the MongoDB C# Driver version in the project's package lock or csproj file.\n- Look for applications that build MongoDB clients from client certificates supplied by different users.","fix":"- Upgrade the MongoDB C# Driver to a patched release; the fixed version is unknown from the sources.\n- Stop building clients from user-supplied certificates, or keep per-user clients separate.","status":"open","published_at":"2026-10-22T19:17:38+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:14:21+00:00","updated_at":"2026-10-25T03:14:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:14:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the MongoDB C# Driver to a patched release; the fixed version is unknown from the sources.\n- Stop building clients from user-supplied certificates, or keep per-user clients separate.","reach":"network","title":"MongoDB C# Driver: shared connections can reuse another user's TLS identity","impact":"high","summary":"The MongoDB C# Driver decides whether two clients can share cached connections by comparing only a TLS client certificate's issuer and serial number. An attacker who copies another user's issuer and serial number, without the private key, can get connections authenticated as that other user.","category":"package","nicknames":[],"who_cares":["mongodb","c#","dotnet","tls-client-certificates","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs database operations under another user's identity and data access","analyst_note":"Find the NVD-linked advisory for the patched MongoDB C# Driver version and confirm which certificate-handling configurations are affected.","how_to_check":"- Check the MongoDB C# Driver version in the project's package lock or csproj file.\n- Look for applications that build MongoDB clients from client certificates supplied by different users.","needs_analyst":true,"not_affected_if":["single-certificate","no-client-certificate-auth"],"who_is_affected":"Applications that use the MongoDB C# Driver with TLS client certificates and create clients from certificates supplied by different users, so that cached connections can be shared between them. Applications that use a single trusted certificate, or that do not use client certificate authentication, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":3403,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114649':15A,18A '-2026':14A,17A 'access':164C 'affect':154C 'anoth':8A,58B,119C 'applic':102C 'attack':55B 'authent':72B,136C 'c':2A,19B,32B,79C 'cach':40B,98C 'certif':29B,48B,84C,107C,117C,142C 'client':28B,37B,47B,83C,95C,105C 'compar':43B,81C 'confidenti':156C 'connect':5A,41B,71B,99C,135C 'copi':57B,118C 'creat':104C 'cve':13A,16A 'data':160C 'databas':143C 'decid':34B,92C 'differ':110C 'dotnet':20B 'driver':3A,33B,80C 'get':70B 'given':134C 'ident':12A,153C,162C 'integr':158C 'issuer':50B,61B,86C,122C 'key':68B,131C 'mongodb':1A,21B,31B,78C 'multi':23B 'multi-ten':22B 'number':53B,64B,89C,125C 'oper':144C 'packag':25B 'privat':67B,130C 'provid':115C 'reus':7A 'run':147C 'serial':52B,63B,88C,124C 'share':4A,39B,97C 'suppli':108C 'tenant':24B 'tls':11A,27B,46B,82C 'tls-client-certif':26B 'two':36B,94C 'user':9A,59B,76B,111C,113C,120C,128C,140C,151C 'whether':35B,93C 'without':65B,126C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the MongoDB C# Driver with TLS client certificates and create clients from certificates supplied by different users, so that cached connections can be shared between them. Applications that use a single trusted certificate, or that do not use client certificate authentication, are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114649","severity":null,"published_at":"2026-10-22T19:17:38+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114649","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114649","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}