Live › vulnerability › CVE-2026-114655
Go to dashboardlibmongocrypt builds requests to AWS, Azure and GCP key management services by inserting key vault and KMS response values into request lines, headers and signed bodies without encoding them. A user with write access to the key vault collection can change request structure, so the application's credentials sign key operations it did not intend.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libmongocrypt for client-side field-level encryption or queryable encryption with an external KMS (AWS, Azure or GCP) and where untrusted parties can write to the key vault collection. The sources do not name affected libmongocrypt versions. Deployments using a local KMS provider or without write access to the key vault collection are unlikely to be exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
This page as .md · .json · in your agent: get_signal("CVE-2026-114655")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.