Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.
CVE-2026-114649
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-114649
C# Driver
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "MongoDB",
"product": "C# Driver",
"versions": [
{
"status": "affected",
"version": "1.8.0",
"lessThan": "3.13.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-114649
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #52383 · Revision 1
- Added to Heist Feed
- Publisher date