CVE-2026-114655

Name of the Vulnerable Software and Affected Versions libmongocrypt (affected versions not specified)

Description libmongocrypt constructs requests to external key management services (AWS, Azure, and GCP) by inserting values from key vault documents, KMS provider configuration, and KMS responses into request lines, headers, and signed request bodies without proper validation or encoding for each context. A user with write access to the key vault collection can manipulate the structure of these requests, which includes adding members to request bodies and token claims that the library subsequently signs using the application's credentials. This can lead to the execution of key management operations with unintended parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.