CVE-2026-116641: The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list.
DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check.
The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DB Toolsto a version that resolves this vulnerability.Fixed in 100.20.0
Event History
Frequently Asked Questions
Which DB Tools releases are affected and which release resolves the issue?
DB Tools 100.19.0 was compiled with Golang 1.26.8 and lacks Golang’s denylist check for the affected eMudhra certificates. DB Tools 100.20.0 updates to Golang 1.27.3, which adds those certificates to the denylist.
What conditions are required for exploitation?
An attacker would need to induce a user to interact with a TLS endpoint presenting a certificate issued by one of the recoverable eMudhra intermediate CAs. The issue is network-reachable, requires no privileges, but has high attack complexity and requires user interaction.
How can I tell whether my deployment is exposed?
Check the installed MongoDB Database Tools version and the Go version used to build it. The described exposure applies to DB Tools 100.19.0, which was built with Golang 1.26.8 rather than the Golang 1.27.3 release containing the eMudhra certificate denylist.