---
id: "CVE-2026-115929"
kind: "vulnerability"
aliases: ["CVE-2026-115929"]
title: "MongoDB Compass: bundled Electron trusts recoverable eMudhra intermediate CA certificates"
severity: "high"
cvss: 7.6
epss: 0.00247
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop", "electron", "mongodb-compass", "package"]
not_affected_if: ["compass-1.53.1-or-later"]
published_at: "2026-10-24T01:17:08+00:00"
first_seen_at: "2026-10-24T01:45:42+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115929", "first_seen_at": "2026-10-24T01:45:42+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115929", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# MongoDB Compass: bundled Electron trusts recoverable eMudhra intermediate CA certificates

MongoDB Compass ships Electron, which carries its own TLS root certificate store that includes recoverable eMudhra intermediate CA certificates. An attacker holding those intermediate keys could issue certificates that Compass accepts as trusted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Compass version with `mongodb-compass --version` or in Help > About
- Compare against `1.53.1`; anything older is affected

## Fix

- Update MongoDB Compass to `1.53.1`, which includes Electron `44.9.1`

## Timeline

- 2026-10-24T01:45:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115929
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115929

## From the sources

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_