Live › vulnerability › CVE-2026-115929
Go to dashboardMongoDB Compass ships Electron, which carries its own TLS root certificate store that includes recoverable eMudhra intermediate CA certificates. An attacker holding those intermediate keys could issue certificates that Compass accepts as trusted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 01:45 UTC. All times on this page are UTC.
Teams that run MongoDB Compass on desktops and use it to connect over TLS are exposed through the Electron certificate store. The sources do not describe a server-side path, so the desktop client is the relevant target. Teams already on Compass 1.53.1 or later are not affected.
No product ranges from the sources yet.
mongodb-compass --version or in Help > About1.53.1; anything older is affected1.53.1, which includes Electron 44.9.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115929")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.