CVE-2026-115929
MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
MongoDB, Inc. CompassDatabases
CVSS
7.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 24 Oct 2026FIRST EPSS
What fixes it
- 1.53.1CompassCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
Text from CVE List
Affected versions 1
- Compassaffected: all versions before 1.53.1CVE List