CVE-2026-115930
MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.
| CWE | CWE-295 |
| Vendor | mongodb, inc. |
| Product | mongosh |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb, inc. mongosh
Be the first to know when new medium vulnerabilities affecting mongodb, inc. mongosh are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
MongoDB, Inc. / mongosh
0 < 2.14.0