CVE-2026-14881

Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

State: Published
Severity: 8.4 High
Published: Jul 22, 2026
Updated: Jul 24, 2026
Reserved: Jul 6, 2026

Read the record on cve.org

Description

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	mongodb
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	mongodb

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

Product	Versions
MongoDB CompassMongoDB	1.38.0 to before 1.49.7Affected

References

https://github.com/mongodb-js/compass/releases/tag/v1.49.7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.