CVE-2026-114655

Name	CVE-2026-114655
Description	libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libmongocrypt (PTS)	bookworm	1.7.2-1	vulnerable
	trixie	1.13.2-1+deb13u1	vulnerable
	forky	1.21.0-1	vulnerable
	sid	1.21.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libmongocrypt	source	(unstable)	1.21.1-1

Notes

https://jira.mongodb.org/browse/MONGOCRYPT-963
https://github.com/mongodb/libmongocrypt/security/advisories/GHSA-7mvq-mg47-m88j
Fixed by: https://github.com/mongodb/libmongocrypt/commit/a83b565593e906710a7d61121ac44ffc190eb21c (1.21.1)