CVE-2026-116641
The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
MongoDB Database ToolsDatabasesCVSS
7.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 100.20.0Database ToolsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list.
DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check.
The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0
Text from CVE List
Affected versions 1
- Database Toolsaffected: all versions before 100.20.0CVE List