Retrospective for 2026-10-26, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.
What this advisory changes in your environment
The starting point is CERTFR-2026-AVI-1386, published on 2026-10-26. Its scope includes libmmongocrypt, C Driver, C# Driver, Compass. Reported consequences are cross-site request forgery (CSRF), data integrity compromise, code execution, SQL injection, denial of service, security control bypass, loss of confidentiality. These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.
This case contains 5 version entries; CVE identifier count: 14. Track remediation by component: a successful overall update does not demonstrate that libmmongocrypt and Compass each received their respective fix.
Products and versions to examine
- Reference
- CERTFR-2026-AVI-1386
- Source first published
- 2026-10-26
- Latest source revision available for this day
- 2026-10-26
- Named components
- libmmongocrypt, C Driver, C# Driver, Compass
- CVE identifiers
- CVE-2026-114645, CVE-2026-114652, CVE-2026-114649, CVE-2026-114646, CVE-2026-114648, CVE-2026-114654, CVE-2026-114653, CVE-2026-114643, CVE-2026-114647, CVE-2026-114650, CVE-2026-114644, CVE-2026-115929, CVE-2026-114651, CVE-2026-114655
| Component | Published condition |
|---|---|
| libmmongocrypt | < 1.21.1 |
| C Driver | 2.5.x : < 2.5.7 |
| C Driver | < 1.30.14 |
| C# Driver | < 3.13.0 |
| Compass | < 1.53.1 |
For libmmongocrypt, the published condition is “< 1.21.1”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of libmmongocrypt, C Driver does not close this case.
Mechanism and prerequisites
SQL injection breaks the boundary between data and instructions. Check parameterised queries, database account privileges and relevant logs; a destructive payload is unnecessary to establish exposure.
The primary record CVE-2026-114655, published by mongodb, covers libmongocrypt. The retained revision is dated 2026-10-22. Its scope is presented separately from the integrations and product groupings in CERTFR-2026-AVI-1386.
The published metric for CVE-2026-114655 is CVSS 4.0, 6/10. The vector below describes technical prerequisites; it does not measure attack frequency or the likelihood that your deployment is compromised.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- network
- Prior privileges
- low
- User interaction
- none
- Complexity
- low
- Additional attack requirements
- present
- Weakness
- CWE-74
Choose the appropriate intervention
- Locate libmmongocrypt instances, running releases and service owners. Record condition < 1.21.1 in the ticket alongside reference CERTFR-2026-AVI-1386.
- Compare the installed branch with the vendor’s libmmongocrypt release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
- After changing libmmongocrypt, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.
Verify the fix in a real workflow
Validation scenario to adapt for libmmongocrypt, C Driver: With libmmongocrypt, run a reference read and transaction in a test database through the application’s actual client. Check account permissions, errors and any replication; distinguish the server release from the driver release. This is a proposed defensive check, not a claim that testing was performed against third-party systems.
Limit of case CERTFR-2026-AVI-1386: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.
Questions specific to this case
Which condition should be checked for libmmongocrypt?
Advisory CERTFR-2026-AVI-1386 states: libmmongocrypt — < 1.21.1. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.
Why not use one fix for libmmongocrypt and Compass?
CERTFR-2026-AVI-1386 distinguishes these components within a scope containing 5 entries. Match each branch to its own update documentation and functional check.
Which prerequisites does record CVE-2026-114655 specify?
For CVE-2026-114655, the published vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Verify those conditions on libmongocrypt before applying them to an integration named in CERTFR-2026-AVI-1386.
Sources and related reading
- CERT-FR · CERTFR-2026-AVI-1386
- Vendor and remediation · jira.mongodb.org
- Vendor and remediation · github.com
- Vendor and remediation · jira.mongodb.org
- Vendor and remediation · jira.mongodb.org
- CVE-2026-114655 · CNA
Practical guide : Data reliability: diagnose a dashboard before making a decision
Explore the decision addressed in this case
Complete source advisory inventory
The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.
Official source · CERTFR-2026-AVI-1386
Advisory revision : · Checked on :
Affected systems · 5
Original French wording is retained to avoid ambiguous translations of version conditions.
- libmmongocrypt versions antérieures à 1.21.1
- C Driver versions 2.5.x antérieures à 2.5.7
- C Driver versions antérieures à 1.30.14
- C# Driver versions antérieures à 3.13.0
- Compass versions antérieures à 1.53.1