CVE-2026-84962
Last modified
CVE-2026-84962 is a medium-severity vulnerability rated 4.2/10 on the CVSS scale. An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.. EPSS estimates a 0.12% chance of exploitation in the next 30 days.
Description
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Libmongocrypt | < 1.20.2 |
References
- https://jira.mongodb.org/browse/MONGOCRYPT-960Vendor Advisory, Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-84962?
How severe is CVE-2026-84962?
How do I fix CVE-2026-84962?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-84942Improper input validation in the Vega expression function im…8.7
- CVE-2026-84947undici's dump interceptor reads and discards a response body…5.3
- CVE-2026-8495Missing Authorization vulnerability in Drupal Date iCal allo…9.8
- CVE-2026-8496A cross-site scripting (XSS) vulnerability exists in Alinto …6.1
- CVE-2026-84960The WP-Members Membership Plugin plugin for WordPress is vul…6.1
- CVE-2026-84961undici's BalancedPool constructor passes its entire options …9.1
- CVE-2026-84963An incorrect numeric conversion in the JSON parsing componen…5.3
- CVE-2026-84964A double free in the OpenSSL-based TLS certificate revocatio…7.5
- CVE-2026-84965An integer wraparound in an allocation size calculation in t…5.5
- CVE-2026-84966An incorrect numeric type conversion in the BSON document bu…5.5
- CVE-2026-84967A component of the MongoDB extension for Visual Studio Code …4.3
- CVE-2026-84968An out-of-bounds read in the BSON decoding component of the …5.3
Are you affected by CVE-2026-84962?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST