CVE-2026-115929: MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
Published Oct 24, 2026
·Updated
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
Affected Software
1 affected component
MongoDB Compass<1.53.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Compassto a version that resolves this vulnerability.Fixed in 1.53.1
Event History
Oct 24, 2026
CVE Published
via MITRE·12:31 AM
Data Sourced
via MITRE·12:31 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Compass versions address this issue?
MongoDB Compass 1.53.1 resolves the issue. This release includes Electron 44.9.1.
2
What must an attacker be able to do to exploit the certificate trust issue?
The attack is network-based and requires user interaction, according to the supplied CVSS vector. No privileges are required.
3
What is the practical impact if exploitation succeeds?
The supplied CVSS vector indicates high confidentiality and integrity impact, with no availability impact.