CVE-2026-115930
Medium
Description
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.
SeverityMedium
CVSS6.8
Exploit probability—
ProductMongodb, Inc. Mongosh
PublishedOct 26, 2026
First seenOct 26, 2026
Weakness typeCWE-295CWE-295
How to fix
Update
- MongoDB, Inc. mongosh2.14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MongoDB, Inc. mongosh | v < 2.14.0 | 2.14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.