CVE-2026-115929 in Compass
Summary
by MITRE • 10/24/2026
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/24/2026
MongoDB Compass utilizes the Electron framework as its underlying runtime environment for rendering user interfaces and managing application logic. A critical security deficiency was identified within this architecture due to the inclusion of recoverable intermediate Certificate Authority certificates from eMudhra in the TLS root certificate store bundled with specific versions of Electron used by MongoDB Compass prior version 1.53.1. The presence of these recoverable private keys associated with an intermediate CA poses a significant risk because it allows for the potential impersonation of any server that trusts this CA chain, effectively undermining the confidentiality and integrity guarantees provided by Transport Layer Security protocols.
The technical flaw stems from the fact that Electron bundles its own set of root certificates rather than relying solely on the operating system's store or a strictly curated subset. In this instance, intermediate CA certificates for eMudhra were included in a manner where their private keys could be recovered or extracted by an attacker with access to the application binary or memory space. This violates fundamental security principles regarding key management and storage, specifically failing to prevent unauthorized disclosure of cryptographic material which is essential for maintaining secure communications.
From an operational perspective, this vulnerability enables sophisticated man-in-the-middle attacks where a malicious actor could decrypt traffic intended for MongoDB servers or other services that trust the eMudhra CA chain if they possess the recovered keys. This compromises data in transit and allows for potential unauthorized access to database operations, configuration changes, or sensitive information stored within MongoDB instances connected via secure connections. The impact is severe as it undermines the foundational security model of encrypted communications between clients and servers.
The issue has been resolved by updating MongoDB Compass to version 1.53.1 which incorporates Electron version 44.9.1. This update removes or properly secures the problematic certificates, ensuring that only trusted root CAs with securely managed private keys are utilized for TLS verification processes. Administrators and users should immediately upgrade to this patched version to eliminate the risk of certificate-based impersonation attacks facilitated by compromised intermediate CA credentials.
This vulnerability aligns with CWE-295 Improper Certificate Validation as it involves handling certificates in a way that allows for trust validation bypass through key compromise, and also relates to CWE-327 Use of a Broken or Risky Cryptographic Algorithm when considering the improper management of cryptographic keys within certificate chains. In terms of MITRE ATT&CK framework tactics, this flaw facilitates T1557 Adversary-in-the-Middle by enabling attackers to intercept and decrypt secure communications if they can exploit the recoverable key material. Organizations must ensure their software supply chain includes up-to-date dependencies that adhere to strict cryptographic best practices to prevent such systemic weaknesses from being introduced into production environments.