CVE-2026-115930

MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs

State: Published
Severity: 7.6 High
Published: Oct 26, 2026
Updated: Oct 26, 2026
Reserved: Oct 23, 2026

Description

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.

Scores

CVSS	Score	Vector	Source
4.0	7.6 High	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	mongodb
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	mongodb

Weaknesses

CWE-295 Improper certificate validation

Affected Products

Product	Versions
mongoshMongoDB, Inc.	before 2.14.0Affected

References

https://www.mongodb.com/docs/mongodb-shell/changelog/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.