CVE-2026-84962
CVE-2026-84962 · Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
CVSS 5.7 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libmongocrypt
- Versions
- ≥ 0, < 1.20.2: Affected (semver)
Update to 1.20.2
libmongocrypt Debian:12
- Versions
- 1.10.0-1
- 1.10.1-1
- 1.11.0-1
- 1.12.0-1
- 1.13.0-1
- 1.13.1-1
- 1.13.2-1
- 1.16.0-1
- 1.17.0-1
- 1.17.3-1
- 1.18.1-1
- 1.18.2-1
- 1.19.0-1
- 1.19.1-1
- 1.20.0-1
- 1.20.1-1
- 1.20.2-1
- 1.20.3-1
- 1.20.4-1
- 1.7.2-1
- 1.8.2-1
- 1.8.4-1
- 1.9.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmongocrypt Debian:13
- Versions
- 1.13.2-1
- 1.13.2-1+deb13u1
- 1.16.0-1
- 1.17.0-1
- 1.17.3-1
- 1.18.1-1
- 1.18.2-1
- 1.19.0-1
- 1.19.1-1
- 1.20.0-1
- 1.20.1-1
- 1.20.2-1
- 1.20.3-1
- 1.20.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmongocrypt Debian:14
- Versions
- 1.13.2-1
- 1.16.0-1
- 1.17.0-1
- 1.17.3-1
- 1.18.1-1
- 1.18.2-1
- 1.19.0-1
- 1.19.1-1
- 1.20.0-1
- 1.20.1-1
- Affected ranges
- ECOSYSTEM: < 1.20.2-1
Update to 1.20.2-1
libmongocrypt Ubuntu:22.04:LTS
- Versions
- 1.2.1-1
- 1.2.2-1
- 1.3.0-1
- 1.3.0-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmongocrypt Ubuntu:24.04:LTS
- Versions
- 1.7.2-1
- 1.8.2-1
- 1.8.4-1
- 1.8.4-1build2
- 1.8.4-1build3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmongocrypt Ubuntu:26.04:LTS
- Versions
- 1.13.2-1
- 1.17.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published