# CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- MongoDB / C# Driver: ≥ 1.8.0; < 3.13.0 (affected, semver). Source: CNA: mongodb

## Severity and prioritization

- CVSS 4.0: 7.6 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: mongodb

- CVSS 3.1: 6.8 (medium); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N; source: CNA: mongodb

- CISA KEV: No listing in collected sources

- EPSS: 0.20% as of 2026-11-01; percentile 9.82%

- SSVC: exploitation poc; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-1025

## Exploit evidence

- exploit: https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-6gjm-424r-3jh2 (ADP: CISA-ADP)

## References

- https://jira.mongodb.org/browse/CSHARP-6184 (CNA: mongodb)

- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 (CNA: mongodb)

- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-6gjm-424r-3jh2 (CNA: mongodb)

- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-6gjm-424r-3jh2 (ADP: CISA-ADP; exploit)

## Provenance

- CNA: mongodb: https://www.cve.org/CVERecord?id=CVE-2026-114649; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-114649; retrieved 2026-11-02; source updated Not reported

Revision: 449780a704d44974cd868485025a8d7f6c5d11c91d5956c9423edccd602e7b76

Canonical: https://y2.dev/cve/CVE-2026-114649