CVE-2026-114655: KMS request injection via unsanitized key vault and provider values in libmongocrypt
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using libmongocrypt with AWS, Azure, or GCP key management services are exposed if an attacker can write to the key vault collection or otherwise control values used in KMS provider configuration or KMS responses.
What access does an attacker need to exploit it?
The described attack requires low-level privileges, specifically write access to the key vault collection. The attacker does not need user interaction, but exploitation has high attack complexity.
What can an attacker cause through exploitation?
An attacker can alter KMS request structure, including adding members to request bodies and token claims that libmongocrypt signs with the application's credentials. This can cause key management operations to be performed with parameters the application did not intend.
What should be done if updating is not immediately possible?
Restrict write access to the key vault collection and prevent untrusted parties from controlling KMS provider configuration or KMS response values. Review access controls for identities able to modify those inputs.