CVE-2026-116641 The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116641?
CVE-2026-116641 is a high-severity vulnerability in MongoDB Database Tools, published on 28 Oct 2026.
Official description
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list.
DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check.
The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0
Weakness: CWE-295
Which versions are affected by CVE-2026-116641?
How do I fix CVE-2026-116641?
No fix has been published for CVE-2026-116641 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116641 being exploited?
There is no known exploitation of CVE-2026-116641 in the wild and no public exploit code.
Sources
Also known as GHSA-5j5x-575j-vr62.