---
id: "CVE-2026-114649"
kind: "vulnerability"
aliases: ["CVE-2026-114649"]
title: "MongoDB C# Driver: shared connections can reuse another user's TLS identity"
severity: "high"
cvss: 7.6
epss: 0.002
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c#", "dotnet", "mongodb", "multi-tenant", "package", "tls-client-certificates"]
not_affected_if: ["no-client-certificate-auth", "single-certificate"]
published_at: "2026-10-22T19:17:38+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:14:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114649", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114649", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# MongoDB C# Driver: shared connections can reuse another user's TLS identity

The MongoDB C# Driver decides whether two clients can share cached connections by comparing only a TLS client certificate's issuer and serial number. An attacker who copies another user's issuer and serial number, without the private key, can get connections authenticated as that other user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MongoDB C# Driver version in the project's package lock or csproj file.
- Look for applications that build MongoDB clients from client certificates supplied by different users.

## Fix

- Upgrade the MongoDB C# Driver to a patched release; the fixed version is unknown from the sources.
- Stop building clients from user-supplied certificates, or keep per-user clients separate.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114649
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114649

## From the sources

The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_